vtpmmgr: Check req_len before unpacking command

vtpm_handle_cmd doesn't ensure there is enough space before unpacking
the req buffer.  Add a minimum size check.  Called functions will have
to do their own checking if they need more data from the request.

The error case is tricky since abort_egress wants to rely with a
corresponding tag.  Just hardcode TPM_TAG_RQU_COMMAND since the vtpm is
sending in malformed commands in the first place.

Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Daniel P. Smith <dpsmith@apertussolutions.com>

diff --git a/stubdom/vtpmmgr/vtpm_cmd_handler.c b/stubdom/vtpmmgr/vtpm_cmd_handler.c
index c879b24c13add8da846b3caa4422d3db24aba1ae..5586be6997b31be0b4dff99b2c5fd24f05bfa5d6 100644 (file)
--- a/stubdom/vtpmmgr/vtpm_cmd_handler.c
+++ b/stubdom/vtpmmgr/vtpm_cmd_handler.c
@@ -840,6 +840,12 @@ TPM_RESULT vtpmmgr_handle_cmd(
        UINT32 size;
        TPM_COMMAND_CODE ord;
 
+       if (tpmcmd->req_len < sizeof_TPM_RQU_HEADER(tpmcmd->req)) {
+               status = TPM_BAD_PARAMETER;
+               tag = TPM_TAG_RQU_COMMAND;
+               goto abort_egress;
+       }
+
        unpack_TPM_RQU_HEADER(tpmcmd->req,
                        &tag, &size, &ord);