From: Simon Glass <sjg@chromium.org>
Date: Fri, 14 May 2021 01:39:29 +0000 (-0600)
Subject: tpm: Check outgoing command size
X-Git-Url: http://git.dujemihanovic.xyz/%22/img/sics.gif/%22/static/git-favicon.png?a=commitdiff_plain;h=fdfae3727ce2d862c5b7d98106c987202d190712;p=u-boot.git

tpm: Check outgoing command size

In tpm_sendrecv_command() the command buffer is passed in. If a mistake is
somehow made in setting this up, the size could be out of range. Add a
sanity check for this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Coverity (CID: 331152)
---

diff --git a/lib/tpm-common.c b/lib/tpm-common.c
index 4277846fdd..82ffdc5341 100644
--- a/lib/tpm-common.c
+++ b/lib/tpm-common.c
@@ -176,6 +176,11 @@ u32 tpm_sendrecv_command(struct udevice *dev, const void *command,
 	}
 
 	size = tpm_command_size(command);
+
+	/* sanity check, which also helps coverity */
+	if (size > COMMAND_BUFFER_SIZE)
+		return log_msg_ret("size", -E2BIG);
+
 	log_debug("TPM request [size:%d]: ", size);
 	for (i = 0; i < size; i++)
 		log_debug("%02x ", ((u8 *)command)[i]);