On 9/24/26 3:41 AM, [email protected] wrote:
Reject any TPM request from being sent to the TPM emulator that is shorter
than the size of the request header.
Fixes: f4ede81eed29 ("tpm: Added support for TPM emulator")
Signed-off-by: Stefan Berger <[email protected]>
Message-ID: <[email protected]>
diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
index 9c95b4d878b5..0c9e32f36a53 100644
--- a/backends/tpm/tpm_emulator.c
+++ b/backends/tpm/tpm_emulator.c
@@ -181,6 +181,11 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_emu,
uint32_t to_read;
ssize_t ret;
+ if (in_len < sizeof(struct tpm_req_hdr)) {
+ error_setg(errp, "tpm-emulator: invalid request size %u", in_len);
+ return -1;
+ }
It could probably be an assert() instead.
The TIS may actually send a command with only 6 bytes.
+
if (selftest_done) {
*selftest_done = false;
is_selftest = tpm_util_is_selftest(in, in_len);
Reviewed-by: Marc-André Lureau <[email protected]>
