Messages in this thread |  | | Subject | Re: [tpmdd-devel] [PATCH v2] tpm: introduce struct tpm_buf | From | Peter Huewe <> | Date | Tue, 09 Jun 2015 13:58:59 +0200 |
| |
Am 9. Juni 2015 13:39:13 MESZ, schrieb Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>: >On Tue, Jun 09, 2015 at 12:32:57PM +0200, Peter Huewe wrote: >> >> >> Hi >> >> >> > +static inline void tpm_buf_store(struct tpm_buf *buf, >> >> > + unsigned int pos, >> >> > + const unsigned char *data, >> >> > + unsigned int len) >> >> > +{ >> >> > + BUG_ON((pos + len) > TPM_BUF_SIZE); >> >> > + >> >> > + memcpy(&buf->data[pos], data, len); >> >> > +} >> >> >> >> Don't you have to update the ->length here? >> > >> >No. Store is for placing value in position, not appending to the >end. >> > >> Then either add a length check (whether ->length is big enough) >and/or >> call the function "update" > >There is a length check in the beginning (first line of the function >body). > Nope. The check in the first line checks whether the write is <= the max buffer size, but not <= head->length.
Since head->length is not updated (as per design) it is possible to write data without effect using this function. This is not what I expect from an API.
Example I create a buffer using tpm_buf_append with 12 bytes, so head->length == 12 Then I use tpm_buf_store at pos 10 and len 4 --> in the buffer are 14 bytes, but tpm_buf_length will only report 12 bytes.
Which is not what I would expect and your current check dies not prevent this.
Peter -- Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet.
|  |