Skip to content

Commit 9dd8fa4

Browse files
shoracekshoracek
committed
tpm2_eventlog: Fix parsing on big-endian systems
Signed-off-by: Štěpán Horáček <shoracek@redhat.com>
1 parent 112f0e5 commit 9dd8fa4

File tree

2 files changed

+148
-146
lines changed

2 files changed

+148
-146
lines changed

‎lib/tpm2_eventlog.c‎

Lines changed: 37 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#include <inttypes.h>
22
#include <stdlib.h>
33
#include <string.h>
4+
#include <endian.h>
45

56
#include <tss2/tss2_tpm2_types.h>
67

@@ -54,7 +55,7 @@ bool foreach_digest2(tpm2_eventlog_context *ctx, UINT32 eventType, unsigned pcr_
5455
return false;
5556
}
5657

57-
const TPMI_ALG_HASH alg = digest->AlgorithmId;
58+
const TPMI_ALG_HASH alg = le16toh(digest->AlgorithmId);
5859
const size_t alg_size = tpm2_alg_util_get_hash_size(alg);
5960
if (size < sizeof(*digest) + alg_size) {
6061
LOG_ERR("insufficient size for digest buffer");
@@ -122,13 +123,13 @@ bool parse_event2body(TCG_EVENT2 const *event, UINT32 type) {
122123
case EV_EFI_VARIABLE_AUTHORITY:
123124
{
124125
UEFI_VARIABLE_DATA *data = (UEFI_VARIABLE_DATA*)event->Event;
125-
if (event->EventSize < sizeof(*data)) {
126+
if (le32toh(event->EventSize) < sizeof(*data)) {
126127
LOG_ERR("size is insufficient for UEFI variable data");
127128
return false;
128129
}
129130

130-
if (event->EventSize < sizeof(*data) + data->UnicodeNameLength *
131-
sizeof(UTF16_CHAR) + data->VariableDataLength)
131+
if (le32toh(event->EventSize) < sizeof(*data) + le64toh(data->UnicodeNameLength) *
132+
sizeof(UTF16_CHAR) + le64toh(data->VariableDataLength))
132133
{
133134
LOG_ERR("size is insufficient for UEFI variable data");
134135
return false;
@@ -146,7 +147,7 @@ bool parse_event2body(TCG_EVENT2 const *event, UINT32 type) {
146147
UEFI_PLATFORM_FIRMWARE_BLOB *data =
147148
(UEFI_PLATFORM_FIRMWARE_BLOB*)event->Event;
148149
UNUSED(data);
149-
if (event->EventSize < sizeof(*data)) {
150+
if (le32toh(event->EventSize) < sizeof(*data)) {
150151
LOG_ERR("size is insufficient for UEFI FW blob data");
151152
return false;
152153
}
@@ -158,7 +159,7 @@ bool parse_event2body(TCG_EVENT2 const *event, UINT32 type) {
158159
{
159160
UEFI_IMAGE_LOAD_EVENT *data = (UEFI_IMAGE_LOAD_EVENT*)event->Event;
160161
UNUSED(data);
161-
if (event->EventSize < sizeof(*data)) {
162+
if (le32toh(event->EventSize) < sizeof(*data)) {
162163
LOG_ERR("size is insufficient for UEFI image load event");
163164
return false;
164165
}
@@ -171,7 +172,7 @@ bool parse_event2body(TCG_EVENT2 const *event, UINT32 type) {
171172
const char hcrtm_data[] = "HCRTM";
172173
size_t len = strlen(hcrtm_data);
173174
BYTE *data = (BYTE *)event->Event;
174-
if (event->EventSize != len ||
175+
if (le32toh(event->EventSize) != len ||
175176
strncmp((const char *)data, hcrtm_data, len)) {
176177
LOG_ERR("HCRTM Event Data MUST be the string: \"%s\"", hcrtm_data);
177178
return false;
@@ -201,9 +202,9 @@ bool parse_event2(TCG_EVENT_HEADER2 const *eventhdr, size_t buf_size,
201202
.data = digests_size,
202203
.digest2_cb = digest2_accumulator_callback,
203204
};
204-
ret = foreach_digest2(&ctx, eventhdr->EventType,
205-
eventhdr->PCRIndex,
206-
eventhdr->Digests, eventhdr->DigestCount,
205+
ret = foreach_digest2(&ctx, le32toh(eventhdr->EventType),
206+
le32toh(eventhdr->PCRIndex),
207+
eventhdr->Digests, le32toh(eventhdr->DigestCount),
207208
buf_size - sizeof(*eventhdr), 0);
208209
if (ret != true) {
209210
return false;
@@ -217,11 +218,11 @@ bool parse_event2(TCG_EVENT_HEADER2 const *eventhdr, size_t buf_size,
217218
}
218219
*event_size += sizeof(*event);
219220

220-
if (buf_size < *event_size + event->EventSize) {
221+
if (buf_size < *event_size + le32toh(event->EventSize)) {
221222
LOG_ERR("size insufficient for event data");
222223
return false;
223224
}
224-
*event_size += event->EventSize;
225+
*event_size += le32toh(event->EventSize);
225226

226227
return true;
227228
}
@@ -238,19 +239,19 @@ bool parse_sha1_log_event(tpm2_eventlog_context *ctx, TCG_EVENT const *event, si
238239
}
239240
*event_size = sizeof(*event);
240241

241-
pcr = ctx->sha1_pcrs[ event->pcrIndex];
242-
if (event->eventType != EV_NO_ACTION && pcr) {
242+
pcr = ctx->sha1_pcrs[le32toh(event->pcrIndex)];
243+
if (le32toh(event->eventType) != EV_NO_ACTION && pcr) {
243244
tpm2_openssl_pcr_extend(TPM2_ALG_SHA1, pcr, &event->digest[0], 20);
244-
ctx->sha1_used |= (1 << event->pcrIndex);
245+
ctx->sha1_used |= (1 << le32toh(event->pcrIndex));
245246
}
246247

247248
/* buffer size must be sufficient to hold event and event data */
248249
if (size < sizeof(*event) + (sizeof(event->event[0]) *
249-
event->eventDataSize)) {
250+
le32toh(event->eventDataSize))) {
250251
LOG_ERR("insufficient size for SpecID event data");
251252
return false;
252253
}
253-
*event_size += event->eventDataSize;
254+
*event_size += le32toh(event->eventDataSize);
254255
return true;
255256
}
256257

@@ -289,14 +290,14 @@ bool foreach_sha1_log_event(tpm2_eventlog_context *ctx, TCG_EVENT const *eventhd
289290
}
290291
}
291292

292-
ret = parse_event2body(event, eventhdr->eventType);
293+
ret = parse_event2body(event, le32toh(eventhdr->eventType));
293294
if (ret != true) {
294295
return ret;
295296
}
296297

297298
/* event data callback */
298299
if (ctx->event2_cb != NULL) {
299-
ret = ctx->event2_cb(event, eventhdr->eventType, ctx->data,
300+
ret = ctx->event2_cb(event, le32toh(eventhdr->eventType), ctx->data,
300301
ctx->eventlog_version);
301302
if (ret != true) {
302303
return false;
@@ -467,12 +468,12 @@ bool foreach_event2(tpm2_eventlog_context *ctx, TCG_EVENT_HEADER2 const *eventhd
467468

468469
TCG_EVENT2 *event = (TCG_EVENT2*)((uintptr_t)eventhdr->Digests + digests_size);
469470

470-
if (eventhdr->EventType == EV_EFI_HCRTM_EVENT && eventhdr->PCRIndex == 0) {
471+
if (le32toh(eventhdr->EventType) == EV_EFI_HCRTM_EVENT && le32toh(eventhdr->PCRIndex) == 0) {
471472
found_hcrtm = true;
472473
}
473474

474475
/* Handle StartupLocality in replay for PCR0 */
475-
if (!found_hcrtm && eventhdr->EventType == EV_NO_ACTION && eventhdr->PCRIndex == 0) {
476+
if (!found_hcrtm && le32toh(eventhdr->EventType) == EV_NO_ACTION && le32toh(eventhdr->PCRIndex) == 0) {
476477
if (event_size < sizeof(EV_NO_ACTION_STRUCT)) {
477478
LOG_ERR("EventSize is too small\n");
478479
return false;
@@ -496,13 +497,13 @@ bool foreach_event2(tpm2_eventlog_context *ctx, TCG_EVENT_HEADER2 const *eventhd
496497
}
497498

498499
/* digest callback foreach digest */
499-
ret = foreach_digest2(ctx, eventhdr->EventType, eventhdr->PCRIndex,
500-
eventhdr->Digests, eventhdr->DigestCount, digests_size, locality);
500+
ret = foreach_digest2(ctx, le32toh(eventhdr->EventType), le32toh(eventhdr->PCRIndex),
501+
eventhdr->Digests, le32toh(eventhdr->DigestCount), digests_size, locality);
501502
if (ret != true) {
502503
return false;
503504
}
504505

505-
ret = parse_event2body(event, eventhdr->EventType);
506+
ret = parse_event2body(event, le32toh(eventhdr->EventType));
506507
if (ret != true) {
507508
return ret;
508509
}
@@ -514,7 +515,7 @@ bool foreach_event2(tpm2_eventlog_context *ctx, TCG_EVENT_HEADER2 const *eventhd
514515

515516
/* event data callback */
516517
if (ctx->event2_cb != NULL) {
517-
ret = ctx->event2_cb(event, eventhdr->EventType, ctx->data, ctx->eventlog_version);
518+
ret = ctx->event2_cb(event, le32toh(eventhdr->EventType), ctx->data, ctx->eventlog_version);
518519
if (ret != true) {
519520
return false;
520521
}
@@ -533,12 +534,12 @@ bool specid_event(TCG_EVENT const *event, size_t size,
533534
return false;
534535
}
535536

536-
if (event->eventType != EV_NO_ACTION) {
537+
if (le32toh(event->eventType) != EV_NO_ACTION) {
537538
LOG_ERR("SpecID eventType must be EV_NO_ACTION");
538539
return false;
539540
}
540541

541-
if (event->pcrIndex != 0) {
542+
if (le32toh(event->pcrIndex) != 0) {
542543
LOG_ERR("bad pcrIndex for EV_NO_ACTION event");
543544
return false;
544545
}
@@ -552,48 +553,48 @@ bool specid_event(TCG_EVENT const *event, size_t size,
552553
}
553554

554555
/* eventDataSize must be sufficient to hold the specid event */
555-
if (event->eventDataSize < sizeof(TCG_SPECID_EVENT)) {
556+
if (le32toh(event->eventDataSize) < sizeof(TCG_SPECID_EVENT)) {
556557
LOG_ERR("invalid eventDataSize in specid event");
557558
return false;
558559
}
559560

560561
/* buffer size must be sufficient to hold event and event data */
561562
if (size < sizeof(*event) + (sizeof(event->event[0]) *
562-
event->eventDataSize)) {
563+
le32toh(event->eventDataSize))) {
563564
LOG_ERR("insufficient size for SpecID event data");
564565
return false;
565566
}
566567

567568
/* specid event must have 1 or more algorithms */
568569
TCG_SPECID_EVENT *event_specid = (TCG_SPECID_EVENT*)event->event;
569-
if (event_specid->numberOfAlgorithms == 0) {
570+
if (le32toh(event_specid->numberOfAlgorithms) == 0) {
570571
LOG_ERR("numberOfAlgorithms is invalid, may not be 0");
571572
return false;
572573
}
573574

574575
/* buffer size must be sufficient to hold event, specid event & algs */
575576
if (size < sizeof(*event) + sizeof(*event_specid) +
576-
sizeof(event_specid->digestSizes[0]) *
577-
event_specid->numberOfAlgorithms) {
577+
sizeof(event_specid->digestSizes[0]) *
578+
le32toh(event_specid->numberOfAlgorithms)) {
578579
LOG_ERR("insufficient size for SpecID algorithms");
579580
return false;
580581
}
581582

582583
/* size must be sufficient for event, specid, algs & vendor stuff */
583584
if (size < sizeof(*event) + sizeof(*event_specid) +
584585
sizeof(event_specid->digestSizes[0]) *
585-
event_specid->numberOfAlgorithms + sizeof(TCG_VENDOR_INFO)) {
586+
le32toh(event_specid->numberOfAlgorithms) + sizeof(TCG_VENDOR_INFO)) {
586587
LOG_ERR("insufficient size for VendorStuff");
587588
return false;
588589
}
589590

590591
TCG_VENDOR_INFO *vendor = (TCG_VENDOR_INFO*)((uintptr_t)event_specid->digestSizes +
591592
sizeof(*event_specid->digestSizes) *
592-
event_specid->numberOfAlgorithms);
593+
le32toh(event_specid->numberOfAlgorithms));
593594
/* size must be sufficient for vendorInfo */
594595
if (size < sizeof(*event) + sizeof(*event_specid) +
595596
sizeof(event_specid->digestSizes[0]) *
596-
event_specid->numberOfAlgorithms + sizeof(*vendor) +
597+
le32toh(event_specid->numberOfAlgorithms) + sizeof(*vendor) +
597598
vendor->vendorInfoSize) {
598599
LOG_ERR("insufficient size for VendorStuff data");
599600
return false;
@@ -614,7 +615,7 @@ bool parse_eventlog(tpm2_eventlog_context *ctx, BYTE const *eventlog, size_t siz
614615
}
615616

616617
TCG_EVENT *event = (TCG_EVENT*)eventlog;
617-
if (event->eventType == EV_NO_ACTION) {
618+
if (le32toh(event->eventType) == EV_NO_ACTION) {
618619
TCG_EVENT_HEADER2 *next;
619620
bool ret = specid_event(event, size, &next);
620621
if (!ret) {

0 commit comments

Comments
 (0)