Skip to content

Commit

Permalink
tpm: fix suspicious sizeof
Browse files Browse the repository at this point in the history
The sizeof on dest in str_padded_copy requires the src to be a fixed
buffer. Since the vendor list is an array of const char pointers,
sizeof on the value is the char pointer not an array of chars. Fix this
by using the _ version where we can control the inputs and use
strlen here since the buffer is gaurenteed to be NUL term over sizeof.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
  • Loading branch information
William Roberts committed Sep 10, 2021
1 parent 6a39746 commit 20f8d05
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
4 changes: 2 additions & 2 deletions src/lib/tpm.c
Original file line number Diff line number Diff line change
Expand Up @@ -751,8 +751,8 @@ CK_RV tpm_get_token_info (tpm_ctx *ctx, CK_TOKEN_INFO *info) {
// otherwise 4 byte ID was already padded and will be used.
for (unsigned int i=0; i < ARRAY_LEN(TPM2_MANUFACTURER_MAP); i++){
if (!strncasecmp((char *)info->manufacturerID, TPM2_MANUFACTURER_MAP[i][0], 4)) {
str_padded_copy(info->manufacturerID,
TPM2_MANUFACTURER_MAP[i][1]);
_str_padded_copy(info->manufacturerID, sizeof(info->manufacturerID),
(const CK_UTF8CHAR_PTR)TPM2_MANUFACTURER_MAP[i][1], strlen(TPM2_MANUFACTURER_MAP[i][1]));
}
}

Expand Down
2 changes: 1 addition & 1 deletion src/lib/utils.h
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@
int str_to_ul(const char *val, size_t *res);

#define str_padded_copy(dst, src) _str_padded_copy(dst, sizeof(dst), (const CK_UTF8CHAR_PTR)src, strnlen((const char *)src, sizeof(src)))
static inline void _str_padded_copy(CK_UTF8CHAR_PTR dst, size_t dst_len, const CK_UTF8CHAR *src, size_t src_len) {
static inline void _str_padded_copy(CK_UTF8CHAR_PTR dst, size_t dst_len, const CK_UTF8CHAR_PTR src, size_t src_len) {
memset(dst, ' ', dst_len);
memcpy(dst, src, src_len);
}
Expand Down

0 comments on commit 20f8d05

Please sign in to comment.