tpm2: Limit the response buffer size indicator to the negotiated size

Limit the variable indicating to the caller how many bytes were returned
in a TPM response to the size returned from TPM2_GetBufferSize(). This
then reflects the buffer size that was negotiated with the
TPMLIB_SetBufferSize() call and for which the recipient of the buffer
should have enough space for.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2026-04-29 22:37:21 +00:00
parent 9ee88f3ad2
commit 5122cec836

View File

@ -231,7 +231,11 @@ static TPM_RESULT TPM2_Process(unsigned char **respbuffer, uint32_t *resp_size,
memcpy(*respbuffer, resp.Buffer, resp.BufferSize);
}
*resp_size = resp.BufferSize;
/*
* Limit the response buffer size to the TPMLIB_SetBufferSize-negotiated
* maximum response size even if this means we truncate the response.
*/
*resp_size = MIN(resp.BufferSize, TPM2_GetBufferSize());
if (g_inFailureMode && !reportedFailureCommand) {
reportedFailureCommand = TRUE;