ExternalVendorCode/go-attestation
1
0
Fork 0
mirror of https://github.com/google/go-attestation.git synced 2025-01-30 07:33:51 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix uint16 overflow in ParseEKCertificate bounds check (#143)

Browse Source
This commit is contained in:
Tom D 2019-12-09 10:58:36 -08:00 committed by GitHub
parent 82eea759eb
commit 9746da2bfe
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
attest/attest_test.go
View File

@ -18,6 +18,8 @@ import (
"bytes" "bytes"
"crypto" "crypto"
"flag" "flag"
"fmt"
"reflect"
"testing" "testing"
) )
@ -163,3 +165,13 @@ func TestBug139(t *testing.T) {
t.Errorf("ParseAKPublic() err = %v, want %v", err, msg) t.Errorf("ParseAKPublic() err = %v, want %v", err, msg)
} }
} }
func TestBug142(t *testing.T) {
// Tests ParseEKCertificate() with a malformed size prefix which would overflow
// an int16, ensuring an error is returned rather than a panic occurring.
input := []byte{0x10, 0x01, 0x00, 0xff, 0xff, 0x20}
wantErr := fmt.Errorf("parsing nvram header: ekCert size %d smaller than specified cert length %d", len(input), 65535)
if _, err := ParseEKCertificate(input); !reflect.DeepEqual(err, wantErr) {
t.Errorf("ParseEKCertificate() = %v, want %v", err, wantErr)
}
}

4
attest/tpm.go
View File

@ -158,8 +158,8 @@ func ParseEKCertificate(ekCert []byte) (*x509.Certificate, error) {
// a prefix when storing a certificate in NVRAM. We look // a prefix when storing a certificate in NVRAM. We look
// for and unwrap the certificate if its present. // for and unwrap the certificate if its present.
if len(ekCert) > 5 && bytes.Equal(ekCert[:3], []byte{0x10, 0x01, 0x00}) { if len(ekCert) > 5 && bytes.Equal(ekCert[:3], []byte{0x10, 0x01, 0x00}) {
certLen := binary.BigEndian.Uint16(ekCert[3:5]) certLen := int(binary.BigEndian.Uint16(ekCert[3:5]))
if len(ekCert) < int(certLen+5) { if len(ekCert) < certLen+5 {
return nil, fmt.Errorf("parsing nvram header: ekCert size %d smaller than specified cert length %d", len(ekCert), certLen) return nil, fmt.Errorf("parsing nvram header: ekCert size %d smaller than specified cert length %d", len(ekCert), certLen)
} }
ekCert = ekCert[5 : 5+certLen] ekCert = ekCert[5 : 5+certLen]