ExternalVendorCode/go-attestation
1
0
Fork 0
mirror of https://github.com/google/go-attestation.git synced 2024-12-18 20:47:57 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Validate signature scheme is present when decoding TPMT_PUBLIC blobs (#140)

Browse Source
This commit is contained in:
Tom D 2019-12-04 14:35:21 -08:00 committed by GitHub
parent fb4487ace5
commit 814084b657
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
attest/attest.go
View File

@ -234,10 +234,20 @@ func ParseAKPublic(version TPMVersion, public []byte) (*AKPublic, error) {
if err != nil {
return nil, fmt.Errorf("parsing TPM public key structure: %v", err)
}
switch {
case pub.RSAParameters == nil && pub.ECCParameters == nil:
return nil, errors.New("parsing public key: missing asymmetric parameters")
case pub.RSAParameters != nil && pub.RSAParameters.Sign == nil:
return nil, errors.New("parsing public key: missing rsa signature scheme")
case pub.ECCParameters != nil && pub.ECCParameters.Sign == nil:
return nil, errors.New("parsing public key: missing ecc signature scheme")
}
pubKey, err := pub.Key()
if err != nil {
return nil, fmt.Errorf("parsing public key: %v", err)
}
var h crypto.Hash
switch pub.Type {
case tpm2.AlgRSA:

11
attest/attest_test.go
View File

@ -152,3 +152,14 @@ func TestPCRs(t *testing.T) {
}
}
}
func TestBug139(t *testing.T) {
// Tests ParseAKPublic() with known parseable but non-spec-compliant blobs, and ensure
// an error is returned rather than a segfault.
// https://github.com/google/go-attestation/issues/139
badBlob := []byte{0, 1, 0, 4, 0, 1, 0, 0, 0, 0, 0, 6, 0, 128, 0, 67, 0, 16, 8, 0, 0, 1, 0, 1, 0, 0}
msg := "parsing public key: missing rsa signature scheme"
if _, err := ParseAKPublic(TPMVersion20, badBlob); err == nil || err.Error() != msg {
t.Errorf("ParseAKPublic() err = %v, want %v", err, msg)
}
}