From 6bca0291dff4691d2cdff29ad1e07f4b6053781d Mon Sep 17 00:00:00 2001 From: Stefan Berger Date: Thu, 5 Mar 2026 10:15:19 -0500 Subject: [PATCH] tpm2: Limit array_size to current size of array (ppList/auditCommands) (BUGFIX) The current libtpms v0.10.2 does not accept a TPM 2 state that was written with a more recent version of libtpms if the sizes of ppList and/or auditCommands increased. Remove the asserts that trigger state reading failures and limit array_size to the sizeof(data->ppList) and sizeof(data->auditCommands) respectively . More recent versions of libtpms, if they support more TPM 2 commands, will extend these arrays but those new commands will not be usable by older versions of libtpms (via profile and StateFormatLevel) and can therefore be ignored by truncating those arrays. Signed-off-by: Stefan Berger --- src/tpm2/NVMarshal.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c index 122d4dff..781a5e57 100644 --- a/src/tpm2/NVMarshal.c +++ b/src/tpm2/NVMarshal.c @@ -4157,8 +4157,11 @@ PERSISTENT_DATA_PPList_Unmarshal(PERSISTENT_DATA *data, BYTE **buffer, INT32 *si rc = ConvertFromCompressedBitArray(buf, array_size, data->ppList, sizeof(data->ppList)); } else { + /* later versions of libtpms may write bigger arrays - truncate them */ + if (array_size > sizeof(data->ppList)) + array_size = sizeof(data->ppList); + memset(data->ppList, 0, sizeof(data->ppList)); - assert(array_size <= sizeof(data->ppList)); memcpy(data->ppList, buf, array_size); } } @@ -4220,8 +4223,11 @@ PERSISTENT_DATA_AuditCommands_Unmarshal(PERSISTENT_DATA *data, BYTE **buffer, IN rc = ConvertFromCompressedBitArray(buf, array_size, data->auditCommands, sizeof(data->auditCommands)); } else { + /* later versions of libtpms may write bigger arrays - truncate them */ + if (array_size > sizeof(data->auditCommands)) + array_size = sizeof(data->auditCommands); + memset(data->auditCommands, 0, sizeof(data->auditCommands)); - assert(array_size <= sizeof(data->auditCommands)); memcpy(data->auditCommands, buf, array_size); } }