From 747e27953002cc8b56dc1dabb5fbf08e064d1fc6 Mon Sep 17 00:00:00 2001 From: Stefan Berger Date: Thu, 5 Mar 2026 10:15:19 -0500 Subject: [PATCH] tpm2: Limit array_size to current size of array (ppList/auditCommands) (BUGFIX) The current libtpms v0.10.2 does not accept a TPM 2 state that was written with a more recent version of libtpms if the sizes of ppList and/or auditCommands increased. Remove the asserts that trigger state reading failures and limit array_size to the sizeof(data->ppList) and sizeof(data->auditCommands) respectively . More recent versions of libtpms, if they support more TPM 2 commands, will extend these arrays but those new commands will not be usable by older versions of libtpms (via profile and StateFormatLevel) and can therefore be ignored by truncating those arrays. Signed-off-by: Stefan Berger --- src/tpm2/NVMarshal.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c index 1a275e53..f8072c70 100644 --- a/src/tpm2/NVMarshal.c +++ b/src/tpm2/NVMarshal.c @@ -4136,8 +4136,11 @@ PERSISTENT_DATA_PPList_Unmarshal(PERSISTENT_DATA *data, BYTE **buffer, INT32 *si rc = ConvertFromCompressedBitArray(buf, array_size, data->ppList, sizeof(data->ppList)); } else { + /* later versions of libtpms may write bigger arrays - truncate them */ + if (array_size > sizeof(data->ppList)) + array_size = sizeof(data->ppList); + memset(data->ppList, 0, sizeof(data->ppList)); - assert(array_size <= sizeof(data->ppList)); memcpy(data->ppList, buf, array_size); } } @@ -4199,8 +4202,11 @@ PERSISTENT_DATA_AuditCommands_Unmarshal(PERSISTENT_DATA *data, BYTE **buffer, IN rc = ConvertFromCompressedBitArray(buf, array_size, data->auditCommands, sizeof(data->auditCommands)); } else { + /* later versions of libtpms may write bigger arrays - truncate them */ + if (array_size > sizeof(data->auditCommands)) + array_size = sizeof(data->auditCommands); + memset(data->auditCommands, 0, sizeof(data->auditCommands)); - assert(array_size <= sizeof(data->auditCommands)); memcpy(data->auditCommands, buf, array_size); } }