Skip to content

Fix a state reading issue due to ppList and auditCommand size increases and cleanups #562

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stefanberger merged 3 commits into from
Mar 5, 2026
Merged

Fix a state reading issue due to ppList and auditCommand size increases and cleanups #562

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
45c2d96
tpm2: Limit array_size to current size of array (ppList/auditCommands…
stefanberger Mar 5, 2026
a620c16
tpm2: Use BITS_TO_BYTES in NVMarshal.c for calculating array sizes
stefanberger Mar 5, 2026
636af2c
tests: Remove checks for sizes of ppList and auditCommands
stefanberger Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 19 additions & 7 deletions src/tpm2/NVMarshal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4087,7 +4087,7 @@ static UINT16
PERSISTENT_DATA_PPList_Marshal(PERSISTENT_DATA *data, BYTE **buffer, INT32 *size,
UINT16 blob_version, UINT32 commandCount)
{
UINT8 ppList[(110 + 7) / 8];
UINT8 ppList[BITS_TO_BYTES(110)];
UINT16 array_size;
UINT16 written;
UINT8 *ptr;
Expand Down Expand Up @@ -4136,9 +4136,15 @@ PERSISTENT_DATA_PPList_Unmarshal(PERSISTENT_DATA *data, BYTE **buffer, INT32 *si
rc = ConvertFromCompressedBitArray(buf, array_size,
data->ppList, sizeof(data->ppList));
} else {
memset(data->ppList, 0, sizeof(data->ppList));
assert(array_size <= sizeof(data->ppList));
/* later versions of libtpms may write bigger arrays - truncate them */
if (array_size > sizeof(data->ppList))
array_size = sizeof(data->ppList);

memcpy(data->ppList, buf, array_size);
/* clear the rest of byte array */
MUST_BE(sizeof(data->ppList[0]) == sizeof(BYTE));
while (array_size < ARRAY_SIZE(data->ppList))
data->ppList[array_size++] = 0;
}
}
}
Expand All @@ -4149,7 +4155,7 @@ static UINT16
PERSISTENT_DATA_AuditCommands_Marshal(PERSISTENT_DATA *data, BYTE **buffer, INT32 *size,
UINT16 blob_version, UINT32 commandCount)
{
UINT8 auditCommands[(110 + 1 + 7) / 8];
UINT8 auditCommands[BITS_TO_BYTES(110 + 1)];
UINT16 array_size;
UINT16 written;
UINT8 *ptr;
Expand All @@ -4161,7 +4167,7 @@ PERSISTENT_DATA_AuditCommands_Marshal(PERSISTENT_DATA *data, BYTE **buffer, INT3
* was using a COMPRESSED_LIST.
*/
assert(commandCount <= 110);
array_size = ((commandCount + 1) + 7) / 8; /* same as in Global.h PERSISTENT_DATA */
array_size = BITS_TO_BYTES(commandCount + 1); /* same as in Global.h PERSISTENT_DATA */
assert(sizeof(auditCommands) >= array_size);
ConvertToCompressedBitArray(data->auditCommands, sizeof(data->auditCommands),
auditCommands, array_size);
Expand Down Expand Up @@ -4199,9 +4205,15 @@ PERSISTENT_DATA_AuditCommands_Unmarshal(PERSISTENT_DATA *data, BYTE **buffer, IN
rc = ConvertFromCompressedBitArray(buf, array_size,
data->auditCommands, sizeof(data->auditCommands));
} else {
memset(data->auditCommands, 0, sizeof(data->auditCommands));
assert(array_size <= sizeof(data->auditCommands));
/* later versions of libtpms may write bigger arrays - truncate them */
if (array_size > sizeof(data->auditCommands))
array_size = sizeof(data->auditCommands);

memcpy(data->auditCommands, buf, array_size);
/* clear the rest of byte array */
MUST_BE(sizeof(data->auditCommands[0]) == sizeof(BYTE));
while (array_size < ARRAY_SIZE(data->auditCommands))
data->auditCommands[array_size++] = 0;
}
}
}
Expand Down
2 changes: 2 additions & 0 deletions src/tpm2/RuntimeCommands.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -413,6 +413,8 @@ RuntimeCommandsCountEnabled(struct RuntimeCommands *RuntimeCommands)
TPM_CC commandCode;
UINT32 count = 0;

/* the following assert must never change */
MUST_BE(TPM_CC_FIRST == TPM_CC_NV_UndefineSpaceSpecial);
for (commandCode = TPM_CC_FIRST;
commandCode < sizeof(RuntimeCommands->enabledCommands) * 8;
commandCode++) {
Expand Down
24 changes: 0 additions & 24 deletions tests/nvram_offsets.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,30 +8,6 @@ extern BYTE s_indexOrderlyRam[RAM_INDEX_SPACE];

int main(void)
{
PERSISTENT_DATA pd;

/* Check size of ppList that expands with new commands */
/* was 14 when COMPRESSED_LISTS was enabled */
#define PD_PP_LIST_EXP_SIZE 17
if (sizeof(pd.ppList) != PD_PP_LIST_EXP_SIZE) {
fprintf(stderr,
"sizeof(PERSISTENT_DATA.ppList) does not have expected size "
"of %u bytes but %zu bytes\n",
PD_PP_LIST_EXP_SIZE, sizeof(pd.ppList));
return EXIT_FAILURE;
}

/* Check size of auditCommands that expands with new commands */
/* was 14 when COMPRESSED_LISTS was enabled */
#define PD_AUDIT_COMMANDS_EXP_SIZE 17
if (sizeof(pd.auditCommands) != PD_AUDIT_COMMANDS_EXP_SIZE) {
fprintf(stderr,
"sizeof(PERSISTENT_DATA.auditCommands) does not have expected size "
"of %u bytes but %zu bytes\n",
PD_AUDIT_COMMANDS_EXP_SIZE, sizeof(pd.auditCommands));
return EXIT_FAILURE;
}

/* ensure that the NVRAM offset of NV_USER_DYNAMIC is at the expected
location so that there's enough memory for re-constructing NVRAM
indices etc. into the NVRAM */
Expand Down