Skip to content

Commit 29e23a6

Browse files
hyperfinitismJuergenReppSIT
hyperfinitism
authored and
JuergenReppSIT
committed
fix(tools): out-of-bounds write with too many auxiliary sessions
Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
1 parent 026427d commit 29e23a6

22 files changed

+87
-107
lines changed

‎tools/tpm2_activatecredential.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -292,13 +292,12 @@ static bool on_option(char key, char *value) {
292292
ctx.rp_hash_path = value;
293293
break;
294294
case 'S':
295-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
296-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
297-
ctx.aux_session_cnt++;
298-
} else {
299-
LOG_ERR("Specify a max of 3 sessions");
295+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
296+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
300297
return false;
301298
}
299+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
300+
++ctx.aux_session_cnt;
302301
break;
303302
}
304303

‎tools/tpm2_certify.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -287,13 +287,12 @@ static bool on_option(char key, char *value) {
287287
}
288288
break;
289289
case 'S':
290-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
291-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
292-
ctx.aux_session_cnt++;
293-
} else {
294-
LOG_ERR("Specify a max of 3 sessions");
290+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
291+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
295292
return false;
296293
}
294+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
295+
++ctx.aux_session_cnt;
297296
break;
298297
}
299298

‎tools/tpm2_certifycreation.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -358,13 +358,12 @@ static bool on_option(char key, char *value) {
358358
ctx.policy_qualifier_data = value;
359359
break;
360360
case 'S':
361-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
362-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
363-
ctx.aux_session_cnt++;
364-
} else {
365-
LOG_ERR("Specify a max of 3 sessions");
361+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
362+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
366363
return false;
367364
}
365+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
366+
++ctx.aux_session_cnt;
368367
break;
369368
/* no default */
370369
}

‎tools/tpm2_changeauth.c‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -326,13 +326,12 @@ static bool on_option(char key, char *value) {
326326
ctx.rp_hash_path = value;
327327
break;
328328
case 'S':
329-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
330-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
331-
ctx.aux_session_cnt++;
332-
} else {
329+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
333330
LOG_ERR("Specify a max of 3 sessions");
334331
return false;
335332
}
333+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
334+
++ctx.aux_session_cnt;
336335
break;
337336
case 'R':
338337
ctx.autoflush = true;

‎tools/tpm2_changeeps.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -164,13 +164,12 @@ static bool on_option(char key, char *value) {
164164
ctx.rp_hash_path = value;
165165
break;
166166
case 'S':
167-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
168-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
169-
ctx.aux_session_cnt++;
170-
} else {
171-
LOG_ERR("Specify a max of 3 sessions");
167+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
168+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
172169
return false;
173170
}
171+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
172+
++ctx.aux_session_cnt;
174173
break;
175174
}
176175

‎tools/tpm2_changepps.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -164,13 +164,12 @@ static bool on_option(char key, char *value) {
164164
ctx.rp_hash_path = value;
165165
break;
166166
case 'S':
167-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
168-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
169-
ctx.aux_session_cnt++;
170-
} else {
171-
LOG_ERR("Specify a max of 3 sessions");
167+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
168+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
172169
return false;
173170
}
171+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
172+
++ctx.aux_session_cnt;
174173
break;
175174
}
176175

‎tools/tpm2_create.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -540,13 +540,12 @@ static bool on_option(char key, char *value) {
540540
ctx.rp_hash_path = value;
541541
break;
542542
case 'S':
543-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
544-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
545-
ctx.aux_session_cnt++;
546-
} else {
547-
LOG_ERR("Specify a max of 3 sessions");
543+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
544+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
548545
return false;
549546
}
547+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
548+
++ctx.aux_session_cnt;
550549
break;
551550
case 'f':
552551
ctx.format = tpm2_convert_pubkey_fmt_from_optarg(value);

‎tools/tpm2_getrandom.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -289,13 +289,12 @@ static bool on_option(char key, char *value) {
289289
ctx.rp_hash_path = value;
290290
break;
291291
case 'S':
292-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
293-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
294-
ctx.aux_session_cnt++;
295-
} else {
296-
LOG_ERR("Specify a max of 3 sessions");
292+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
293+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
297294
return false;
298295
}
296+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
297+
++ctx.aux_session_cnt;
299298
break;
300299
/* no default */
301300
}

‎tools/tpm2_nvcertify.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -484,13 +484,12 @@ static bool on_option(char key, char *value) {
484484
ctx.rp_hash_path = value;
485485
break;
486486
case 'S':
487-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
488-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
489-
ctx.aux_session_cnt++;
490-
} else {
491-
LOG_ERR("Specify a max of 3 sessions");
487+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
488+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
492489
return false;
493490
}
491+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
492+
++ctx.aux_session_cnt;
494493
break;
495494
case 'n':
496495
ctx.precalc_nvname.size = BUFFER_SIZE(TPM2B_NAME, name);

‎tools/tpm2_nvdefine.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -453,12 +453,12 @@ static bool on_option(char key, char *value) {
453453
ctx.rp_hash_path = value;
454454
break;
455455
case 'S':
456-
ctx.aux_session_path[ctx.aux_session_cnt] = value;
457-
if (ctx.aux_session_cnt < MAX_AUX_SESSIONS) {
458-
ctx.aux_session_cnt++;
459-
} else {
456+
if (ctx.aux_session_cnt >= MAX_AUX_SESSIONS) {
457+
LOG_ERR("Specify a max of %u auxiliary sessions", MAX_AUX_SESSIONS);
460458
return false;
461459
}
460+
ctx.aux_session_path[ctx.aux_session_cnt] = value;
461+
++ctx.aux_session_cnt;
462462
break;
463463
case 'g':
464464
ctx.halg = tpm2_alg_util_from_optarg(value,

0 commit comments

Comments
 (0)