tpm2: rev155: Fix a bug in the RSAES decoder checking bounds

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2019-08-02 15:21:05 -04:00 committed by Stefan Berger
parent c1f7bf5509
commit 480d42bb9f

View File

@ -481,7 +481,7 @@ RSAES_Decode(
pSize++;
// Make sure that pSize has not gone over the end and that there are at least 8
// bytes of pad data.
fail = (pSize >= coded->size) | fail;
fail = (pSize > coded->size) | fail;
fail = ((pSize - 2) < 8) | fail;
if((message->size < (UINT16)(coded->size - pSize)) || fail)
return TPM_RC_VALUE;