> When the CRB receives a TPM reponse from the backend, then reject responses
> that are shorter than the TPM_HEADER_SIZE. When determining the size of the
> reponse, also consider the length of the response_buffer as being possibly
> shorter than the negotiated backend buffer size or the size indicated in
> the response itself.
Since the backend is considered trusted, this is not a security issue.
>
> Fixes: 2a660ad67d15 ("hw/tpm: Implement TPM CRB chunking logic")
> Signed-off-by: Stefan Berger <[email protected]>
> Message-ID: <[email protected]>
>
> diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
> index 4bd1919952c1..6ae2261b43e3 100644
> --- a/hw/tpm/tpm_crb.c
> +++ b/hw/tpm/tpm_crb.c
> @@ -325,13 +325,15 @@ static void tpm_crb_request_completed(TPMIf *ti, int
> ret)
> CRBState *s = CRB(ti);
>
> ARRAY_FIELD_DP32(s->regs, CRB_CTRL_START, Start, 0);
> - if (ret != 0) {
> + if (ret != 0 || s->response_buffer->len < TPM_HEADER_SIZE) {
> ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
> tpmSts, 1); /* fatal error */
> tpm_crb_clear_internal_buffers(s);
> } else {
> uint32_t actual_resp_size =
> tpm_cmd_get_size(s->response_buffer->data);
> uint32_t total_resp_size = MIN(actual_resp_size, s->be_buffer_size);
> +
> + total_resp_size = MIN(total_resp_size, s->response_buffer->len);
> g_byte_array_set_size(s->response_buffer, total_resp_size);
> s->response_offset = 0;
> }
Reviewed-by: Marc-André Lureau <[email protected]>
--
Marc-André Lureau <[email protected]>
