Fix Fenrir F-1755/F-1762: wolfTPM2_NVReadAuthPolicy read size check

dgarske · dgarske · commit d20af383d624 · 2026-04-06T15:58:05.000-07:00
diff --git a/src/tpm2_wrap.c b/src/tpm2_wrap.c
@@ -5233,6 +5233,10 @@ int wolfTPM2_NVReadAuthPolicy(WOLFTPM2_DEV* dev, WOLFTPM2_SESSION* tpmSession,
         }
 
         toread = out.data.size;
+        if (toread > dataSz) {
+            rc = BAD_FUNC_ARG;
+            break;
+        }
         if (dataBuf) {
             XMEMCPY(&dataBuf[pos], out.data.buffer, toread);
         }

Original file line number	Diff line number	Diff line change
`@@ -5233,6 +5233,10 @@ int wolfTPM2_NVReadAuthPolicy(WOLFTPM2_DEV* dev, WOLFTPM2_SESSION* tpmSession,`
`5233`	`5233`	`}`
`5234`	`5234`
`5235`	`5235`	`toread = out.data.size;`
	`5236`	`+ if (toread > dataSz) {`
	`5237`	`+ rc = BAD_FUNC_ARG;`
	`5238`	`+ break;`
	`5239`	`+ }`
`5236`	`5240`	`if (dataBuf) {`
`5237`	`5241`	`XMEMCPY(&dataBuf[pos], out.data.buffer, toread);`
`5238`	`5242`	`}`