summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaisuke Nojiri <dnojiri@chromium.org>2014-05-02 17:18:04 (GMT)
committerchrome-internal-fetch <chrome-internal-fetch@google.com>2014-05-06 06:02:12 (GMT)
commit6633111d7252b2761048e9da0da2f7f58eb573c3 (patch)
tree63ce8d3b8aceab9231a25e538d351a32bf9795bb
parent1684816a24f13cf657df439f44aad50cc409a4ec (diff)
downloaddepthcharge-stabilize-5828.0.B.tar.gz
depthcharge-stabilize-5828.0.B.tar.xz
vboot: Convert response_length from uint32_t to size_t in VbExTpmSendReceivestabilize-5828.0.B
Length arguments for VbExTpmSendReceive have type uint32_t but it calls function which expects size_t. This change converts uint32_t to size_t on call and size_t to uint32_t on return. BUG=None BRANCH=None TEST=Booted Nyan Big to Linux Change-Id: I3d239c1b5598fdf27afff4c792bf7f1e4d2706d0 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/198015
-rw-r--r--src/vboot/callbacks/tpm.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/src/vboot/callbacks/tpm.c b/src/vboot/callbacks/tpm.c
index ce786af..d136761 100644
--- a/src/vboot/callbacks/tpm.c
+++ b/src/vboot/callbacks/tpm.c
@@ -43,7 +43,12 @@ VbError_t VbExTpmOpen(void)
VbError_t VbExTpmSendReceive(const uint8_t *request, uint32_t request_length,
uint8_t *response, uint32_t *response_length)
{
- if (tpm_xmit(request, request_length, response, response_length))
+ size_t len = *response_length;
+ if (tpm_xmit(request, request_length, response, &len))
return VBERROR_UNKNOWN;
+ /* check 64->32bit overflow and (re)check response buffer overflow */
+ if (len > *response_length)
+ return VBERROR_UNKNOWN;
+ *response_length = len;
return VBERROR_SUCCESS;
}