This series of patches fixes various issues in TPM-related code, such as memory leaks, potential integer underflows, clearing of buffers while they are in use, and the proper handling of sizes of commands or responses.
Regards, Stefan v3: - 6/10: Remove call to clearing of buffers v2: - Address issues pointed out by Marc-André Stefan Berger (10): tpm_util: Pass TPMVersion to function writing fatal error response tpm_emulator: Reject TPM responses whose size is too small tpm_emulator: Reject sending commands smaller than the request header hw/tpm: tis: Only read from response buffer if rw_offset < len hw/tpm: tis: Use uint32_t for len to avoid truncating size of command hw/tpm: crb: Do not clear internal buffers when backend is busy hw/tpm: crb: Avoid potential integer underflow hw/tpm: crb: Implement tpm_ppi_uninit and use it in tpm_crb_unrealize hw/tpm: crb: Consider response_buffer->len of received response tests: Add tests with commands with bad length backends/tpm/tpm_emulator.c | 12 ++++-- backends/tpm/tpm_passthrough.c | 2 +- backends/tpm/tpm_util.c | 17 ++++++-- hw/tpm/tpm_crb.c | 21 +++++++--- hw/tpm/tpm_ppi.c | 10 +++++ hw/tpm/tpm_ppi.h | 10 +++++ hw/tpm/tpm_tis_common.c | 8 ++-- include/system/tpm_util.h | 3 +- tests/qtest/tpm-crb-swtpm-test.c | 10 +++++ tests/qtest/tpm-tests.c | 56 +++++++++++++++++++++++++ tests/qtest/tpm-tests.h | 8 ++++ tests/qtest/tpm-tis-device-swtpm-test.c | 10 +++++ tests/qtest/tpm-tis-swtpm-test.c | 10 +++++ tests/qtest/tpm-util.c | 55 ++++++++++++++++++++++++ tests/qtest/tpm-util.h | 3 ++ 15 files changed, 219 insertions(+), 16 deletions(-) -- 2.55.0
