vtpmmgr: Check req_len before unpacking command
authorJason Andryuk <jandryuk@gmail.com>
Thu, 6 May 2021 13:59:22 +0000 (09:59 -0400)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Mon, 10 May 2021 13:50:33 +0000 (14:50 +0100)
commit5974702bddd37445ae2104f567d88c400227d5d4
treeebfa4fa01af1acd499649ab00c9ba40f4c82e10e
parentc8d8a1e2e6a1fdba45dd9e9fb993d79d1e5a097c
vtpmmgr: Check req_len before unpacking command

vtpm_handle_cmd doesn't ensure there is enough space before unpacking
the req buffer.  Add a minimum size check.  Called functions will have
to do their own checking if they need more data from the request.

The error case is tricky since abort_egress wants to rely with a
corresponding tag.  Just hardcode TPM_TAG_RQU_COMMAND since the vtpm is
sending in malformed commands in the first place.

Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
stubdom/vtpmmgr/vtpm_cmd_handler.c