On Thu, 30 Apr 2026 15:51:50 +0000, Stefan Berger <[email protected]> wrote: > diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c > index 653989ac0e3..050a1f4225c 100644 > --- a/backends/tpm/tpm_emulator.c > +++ b/backends/tpm/tpm_emulator.c > @@ -195,9 +196,13 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator > *tpm_emu, > return -1; > } > > + /* > + * Size of response from swtpm must be <= out_len (= negotiated buffer > size) > + */ > + to_read = MIN(tpm_cmd_get_size(out), out_len) - sizeof(struct > tpm_resp_hdr);
I would check tpm_cmd_get_size(out) <= out_len explicitly and return an error (probaby then disconnect) rather than silently corrupting the stream. -- Marc-André Lureau <[email protected]>
