leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Atmel TPM: Fix potential buffer overruns

Browse Source 
Ensure that the Atmel TPM driver performs sufficient
validation of the length returned in the TPM response header.
This patch prevents memory corruption if the header contains a
length value that is larger than the destination buffer.

Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
This commit is contained in:
Jeremy Boone 2018-02-12 17:56:37 -05:00 committed by Tom Rini
parent afe0e6bddf
commit b3f4070340
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/tpm/tpm_atmel_twi.c
View File

@ -106,13 +106,23 @@ static int tpm_atmel_twi_xfer(struct udevice *dev,
udelay(100);
}
if (!res) {
*recv_len = get_unaligned_be32(recvbuf + 2);
if (*recv_len > 10)
unsigned int hdr_recv_len;
hdr_recv_len = get_unaligned_be32(recvbuf + 2);
if (hdr_recv_len < 10) {
puts("tpm response header too small\n");
return -1;
} else if (hdr_recv_len > *recv_len) {
puts("tpm response length is bigger than receive buffer\n");
return -1;
} else {
*recv_len = hdr_recv_len;
#ifndef CONFIG_DM_I2C
res = i2c_read(0x29, 0, 0, recvbuf, *recv_len);
#else
res = dm_i2c_read(dev, 0, recvbuf, *recv_len);
#endif
}
}
if (res) {
printf("i2c_read returned %d (rlen=%d)\n", res, *recv_len);