Infineon TPM: Fix potential buffer overruns
Ensure that the Infineon I2C and SPI TPM driver performs adequate
validation of the length extracted from the TPM response header.
This patch prevents integer underflow when the length was too small,
which could lead to memory corruption.
Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
diff --git a/drivers/tpm/tpm_tis_infineon.c b/drivers/tpm/tpm_tis_infineon.c
index e3e20d8..41b748e 100644
--- a/drivers/tpm/tpm_tis_infineon.c
+++ b/drivers/tpm/tpm_tis_infineon.c
@@ -374,7 +374,8 @@
{
struct tpm_chip *chip = dev_get_priv(dev);
int size = 0;
- int expected, status;
+ int status;
+ unsigned int expected;
int rc;
status = tpm_tis_i2c_status(dev);
@@ -394,7 +395,7 @@
}
expected = get_unaligned_be32(buf + TPM_RSP_SIZE_BYTE);
- if ((size_t)expected > count) {
+ if ((size_t)expected > count || (size_t)expected < TPM_HEADER_SIZE) {
debug("Error size=%x, expected=%x, count=%x\n", size, expected,
count);
return -ENOSPC;