lkml.org 
[lkml]   [2015]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [tpmdd-devel] [PATCH v2] tpm: introduce struct tpm_buf
From
Date


Am 9. Juni 2015 13:39:13 MESZ, schrieb Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>:
>On Tue, Jun 09, 2015 at 12:32:57PM +0200, Peter Huewe wrote:
>>
>>
>> Hi
>>
>> >> > +static inline void tpm_buf_store(struct tpm_buf *buf,
>> >> > + unsigned int pos,
>> >> > + const unsigned char *data,
>> >> > + unsigned int len)
>> >> > +{
>> >> > + BUG_ON((pos + len) > TPM_BUF_SIZE);
>> >> > +
>> >> > + memcpy(&buf->data[pos], data, len);
>> >> > +}
>> >>
>> >> Don't you have to update the ->length here?
>> >
>> >No. Store is for placing value in position, not appending to the
>end.
>> >
>> Then either add a length check (whether ->length is big enough)
>and/or
>> call the function "update"
>
>There is a length check in the beginning (first line of the function
>body).
>
Nope.
The check in the first line checks whether the write is <= the max buffer size,
but not <= head->length.

Since head->length is not updated (as per design) it is possible to write data without effect using this function.
This is not what I expect from an API.


Example I create a buffer using tpm_buf_append with 12 bytes, so head->length == 12
Then I use tpm_buf_store at pos 10 and len 4 --> in the buffer are 14 bytes, but tpm_buf_length will only report 12 bytes.

Which is not what I would expect and your current check dies not prevent this.

Peter
--
Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet.


\
 
 \ /
  Last update: 2015-06-09 14:21    [W:0.059 / U:0.172 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site