> Only read a byte from the response buffer, if the rw_offset < len. OOB read from malicious driver is CVE-level.
> > Signed-off-by: Stefan Berger <[email protected]> > Message-ID: <[email protected]> > > diff --git a/hw/tpm/tpm_tis_common.c b/hw/tpm/tpm_tis_common.c > index a134d5c20599..4ba228116b64 100644 > --- a/hw/tpm/tpm_tis_common.c > +++ b/hw/tpm/tpm_tis_common.c > @@ -273,13 +273,15 @@ static uint32_t tpm_tis_data_read(TPMState *s, uint8_t > locty) > len = MIN(tpm_cmd_get_size(&s->buffer), > s->be_buffer_size); > > - ret = s->buffer[s->rw_offset++]; > + if (s->rw_offset < len) { > + ret = s->buffer[s->rw_offset++]; > + trace_tpm_tis_data_read(ret, s->rw_offset - 1); > + } > if (s->rw_offset >= len) { > /* got last byte */ > tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID); > tpm_tis_raise_irq(s, locty, TPM_TIS_INT_STS_VALID); > } > - trace_tpm_tis_data_read(ret, s->rw_offset - 1); > } > > return ret; Reviewed-by: Marc-André Lureau <[email protected]> -- Marc-André Lureau <[email protected]>
