Merge pull request #125 from datachainlab/audit-202409-s-2-3

S-{2,3}: Fix audit suggestions

Signed-off-by: Jun Kimura <jun.kimura@datachain.jp>

modules/lcp-client/src/client_def.rs

@@ -104,7 +104,7 @@ impl LCPClient {
         Ok(())
     }
 
-    // verify_client_message verifies a client message
+    /// update_client verifies a client message and updates the state of the client
     pub fn update_client(
         &self,
         ctx: &mut dyn HostClientKeeper,

modules/remote-attestation/src/ias_utils.rs

@@ -87,7 +87,7 @@ pub(crate) fn get_quote(
         info!("quote size = {}", quote_size);
 
         let mut qe_report = sgx_report_t::default();
-        let quote = [0u8; 2048];
+        let quote: Vec<u8> = vec![0; quote_size as usize];
         let p_quote = quote.as_ptr();
         let ret = unsafe {
             sgx_get_quote(
@@ -105,7 +105,7 @@ pub(crate) fn get_quote(
         if ret != sgx_status_t::SGX_SUCCESS {
             return Err(Error::sgx_error(ret, "failed to sgx_get_quote".into()));
         }
-        (quote[..quote_size as usize].to_vec(), qe_report)
+        (quote, qe_report)
     };
 
     // Check qe_report to defend against replay attack
@@ -415,6 +415,7 @@ pub(crate) fn decode_spid(spid_str: &str) -> Result<sgx_spid_t, Error> {
         }
     };
     let mut spid = sgx_spid_t::default();
-    spid.id.copy_from_slice(&decoded_vec[..16]);
+    // the length of `decoded_vec` is 16 because each byte is represented by 2 characters
+    spid.id.copy_from_slice(&decoded_vec);
     Ok(spid)
 }