From: Peter Huewe <peterhuewe@gmx.de>
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: "moderated list:TPM DEVICE DRIVER"
<tpmdd-devel@lists.sourceforge.net>,
safford@us.ibm.com, open list <linux-kernel@vger.kernel.org>
Subject: Re: [tpmdd-devel] [PATCH v2] tpm: introduce struct tpm_buf
Date: Tue, 09 Jun 2015 13:58:59 +0200 [thread overview]
Message-ID: <41179E5D-88E5-46B0-BEB8-6D759F917BDD@gmx.de> (raw)
In-Reply-To: <20150609113913.GA1079@jsakkine-mobl1>
Am 9. Juni 2015 13:39:13 MESZ, schrieb Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>:
>On Tue, Jun 09, 2015 at 12:32:57PM +0200, Peter Huewe wrote:
>>
>>
>> Hi
>>
>> >> > +static inline void tpm_buf_store(struct tpm_buf *buf,
>> >> > + unsigned int pos,
>> >> > + const unsigned char *data,
>> >> > + unsigned int len)
>> >> > +{
>> >> > + BUG_ON((pos + len) > TPM_BUF_SIZE);
>> >> > +
>> >> > + memcpy(&buf->data[pos], data, len);
>> >> > +}
>> >>
>> >> Don't you have to update the ->length here?
>> >
>> >No. Store is for placing value in position, not appending to the
>end.
>> >
>> Then either add a length check (whether ->length is big enough)
>and/or
>> call the function "update"
>
>There is a length check in the beginning (first line of the function
>body).
>
Nope.
The check in the first line checks whether the write is <= the max buffer size,
but not <= head->length.
Since head->length is not updated (as per design) it is possible to write data without effect using this function.
This is not what I expect from an API.
Example I create a buffer using tpm_buf_append with 12 bytes, so head->length == 12
Then I use tpm_buf_store at pos 10 and len 4 --> in the buffer are 14 bytes, but tpm_buf_length will only report 12 bytes.
Which is not what I would expect and your current check dies not prevent this.
Peter
--
Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet.
next prev parent reply other threads:[~2015-06-09 11:59 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-06-03 16:39 [PATCH v2] tpm: introduce struct tpm_buf Jarkko Sakkinen
2015-06-08 20:39 ` Peter Hüwe
2015-06-09 9:19 ` Jarkko Sakkinen
2015-06-09 10:32 ` [tpmdd-devel] " Peter Huewe
2015-06-09 11:39 ` Jarkko Sakkinen
2015-06-09 11:58 ` Peter Huewe [this message]
2015-06-09 12:05 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=41179E5D-88E5-46B0-BEB8-6D759F917BDD@gmx.de \
--to=peterhuewe@gmx.de \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=safford@us.ibm.com \
--cc=tpmdd-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).