> Reject any TPM request from being sent to the TPM emulator that is shorter
> than the size of the request header.
>
> Fixes: f4ede81eed29 ("tpm: Added support for TPM emulator")
> Signed-off-by: Stefan Berger <[email protected]>
> Message-ID: <[email protected]>
>
> diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
> index 9c95b4d878b5..0c9e32f36a53 100644
> --- a/backends/tpm/tpm_emulator.c
> +++ b/backends/tpm/tpm_emulator.c
> @@ -181,6 +181,11 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator
> *tpm_emu,
> uint32_t to_read;
> ssize_t ret;
>
> + if (in_len < sizeof(struct tpm_req_hdr)) {
> + error_setg(errp, "tpm-emulator: invalid request size %u", in_len);
> + return -1;
> + }
It could probably be an assert() instead.
> +
> if (selftest_done) {
> *selftest_done = false;
> is_selftest = tpm_util_is_selftest(in, in_len);
Reviewed-by: Marc-André Lureau <[email protected]>
--
Marc-André Lureau <[email protected]>
