diff --git a/src/tpm2/AttestationCommands.c b/src/tpm2/AttestationCommands.c index 78943448..d65386bc 100644 --- a/src/tpm2/AttestationCommands.c +++ b/src/tpm2/AttestationCommands.c @@ -203,9 +203,10 @@ TPM2_GetSessionAuditDigest( GetSessionAuditDigest_Out *out // OUT: output parameter list ) { - SESSION *session = SessionGet(in->sessionHandle); - TPMS_ATTEST auditInfo; - OBJECT *signObject = HandleToObject(in->signHandle); + SESSION* session = SessionGet(in->sessionHandle); + pAssert_RC(session); + TPMS_ATTEST auditInfo; + OBJECT* signObject = HandleToObject(in->signHandle); // Input Validation if(!IsSigningObject(signObject)) return TPM_RCS_KEY + RC_GetSessionAuditDigest_signHandle; diff --git a/src/tpm2/ContextCommands.c b/src/tpm2/ContextCommands.c index eadaec5f..a913c126 100644 --- a/src/tpm2/ContextCommands.c +++ b/src/tpm2/ContextCommands.c @@ -151,8 +151,8 @@ TPM2_ContextSave(ContextSave_In* in, // IN: input parameter list out->context.contextBlob.t.size = integritySize + fingerprintSize + objectSize; // Make sure things fit - pAssert(out->context.contextBlob.t.size - <= sizeof(out->context.contextBlob.t.buffer)); + pAssert_RC(out->context.contextBlob.t.size + <= sizeof(out->context.contextBlob.t.buffer)); // Copy the whole internal OBJECT structure to context blob MemoryCopy(outObject, objbuf, objectSize); // libtpms changed // Increment object context ID @@ -195,15 +195,15 @@ TPM2_ContextSave(ContextSave_In* in, // IN: input parameter list integritySize + fingerprintSize + sizeof(*session); // Make sure things fit - pAssert(out->context.contextBlob.t.size - < sizeof(out->context.contextBlob.t.buffer)); + pAssert_RC(out->context.contextBlob.t.size + < sizeof(out->context.contextBlob.t.buffer)); // Copy the whole internal SESSION structure to context blob. // Save space for fingerprint at the beginning of the buffer // This is done before anything else so that the actual context // can be reclaimed after this call - pAssert(sizeof(*session) <= sizeof(out->context.contextBlob.t.buffer) - - integritySize - fingerprintSize); + pAssert_RC(sizeof(*session) <= sizeof(out->context.contextBlob.t.buffer) + - integritySize - fingerprintSize); MemoryCopy( out->context.contextBlob.t.buffer + integritySize + fingerprintSize, session, @@ -233,8 +233,8 @@ TPM2_ContextSave(ContextSave_In* in, // IN: input parameter list // Save fingerprint at the beginning of encrypted area of context blob. // Reserve the integrity space - pAssert(sizeof(out->context.sequence) - <= sizeof(out->context.contextBlob.t.buffer) - integritySize); + pAssert_RC(sizeof(out->context.sequence) + <= sizeof(out->context.contextBlob.t.buffer) - integritySize); MemoryCopy(out->context.contextBlob.t.buffer + integritySize, &out->context.sequence, sizeof(out->context.sequence)); diff --git a/src/tpm2/EACommands.c b/src/tpm2/EACommands.c index b313d73b..e274a533 100644 --- a/src/tpm2/EACommands.c +++ b/src/tpm2/EACommands.c @@ -92,6 +92,7 @@ TPM2_PolicySigned(PolicySigned_In* in, // IN: input parameter list // Input Validation // Set up local pointers session = SessionGet(in->policySession); // the session structure + pAssert_RC(session); // Only do input validation if this is not a trial policy session if(session->attributes.isTrialPolicy == CLEAR) @@ -254,6 +255,7 @@ TPM2_PolicySecret(PolicySecret_In* in, // IN: input parameter list // Input Validation // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); //Only do input validation if this is not a trial policy session if(session->attributes.isTrialPolicy == CLEAR) @@ -360,6 +362,7 @@ TPM2_PolicyTicket(PolicyTicket_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // NOTE: A trial policy session is not allowed to use this command. // A ticket is used in place of a previously given authorization. Since @@ -458,6 +461,7 @@ TPM2_PolicyOR(PolicyOR_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // Compare and Update Internal Session policy if match for(i = 0; i < in->pHashList.count; i++) @@ -613,6 +617,7 @@ TPM2_PolicyPhysicalPresence(PolicyPhysicalPresence_In* in // IN: input paramete // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // Update policy hash // policyDigestnew = hash(policyDigestold || TPM_CC_PolicyPhysicalPresence) @@ -662,6 +667,7 @@ TPM2_PolicyLocality(PolicyLocality_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // Get new locality setting in canonical form marshalBuffer[0] = 0; // Code analysis says that this is not initialized @@ -776,6 +782,7 @@ TPM2_PolicyNV(PolicyNV_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); //If this is a trial policy, skip all validations and the operation if(session->attributes.isTrialPolicy == CLEAR) @@ -889,6 +896,7 @@ TPM2_PolicyCounterTimer(PolicyCounterTimer_In* in // IN: input parameter list return TPM_RCS_RANGE; // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); //If this is a trial policy, skip the check to see if the condition is met. if(session->attributes.isTrialPolicy == CLEAR) @@ -970,6 +978,7 @@ TPM2_PolicyCommandCode(PolicyCommandCode_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); if(session->commandCode != 0 && session->commandCode != in->code) return TPM_RCS_VALUE + RC_PolicyCommandCode_code; @@ -1028,6 +1037,7 @@ TPM2_PolicyCpHash(PolicyCpHash_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // A valid cpHash must have the same size as session hash digest // NOTE: the size of the digest can't be zero because TPM_ALG_NULL @@ -1094,6 +1104,7 @@ TPM2_PolicyNameHash(PolicyNameHash_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // A valid nameHash must have the same size as session hash digest // Since the authHashAlg for a session cannot be TPM_ALG_NULL, the digest size @@ -1159,6 +1170,7 @@ TPM2_PolicyDuplicationSelect( // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // nameHash in session context must be empty if(session->u1.nameHash.t.size != 0) @@ -1248,6 +1260,7 @@ TPM2_PolicyAuthorize(PolicyAuthorize_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); if(in->keySign.t.size < 2) { @@ -1337,6 +1350,7 @@ TPM2_PolicyAuthValue(PolicyAuthValue_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // Update policy hash // policyDigestnew = hash(policyDigestold || TPM_CC_PolicyAuthValue) @@ -1384,6 +1398,7 @@ TPM2_PolicyPassword(PolicyPassword_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // Update policy hash // policyDigestnew = hash(policyDigestold || TPM_CC_PolicyAuthValue) @@ -1422,6 +1437,8 @@ TPM2_PolicyGetDigest( // Command Output // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); + out->policyDigest = session->u2.policyDigest; return TPM_RC_SUCCESS; } @@ -1448,6 +1465,7 @@ TPM2_PolicyNvWritten(PolicyNvWritten_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // If already set is this a duplicate (the same setting)? If it // is a conflicting setting, it is an error @@ -1511,6 +1529,7 @@ TPM2_PolicyTemplate(PolicyTemplate_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // error if the templateHash in session context is not empty and is not the // same as the input or is not a template @@ -1586,6 +1605,7 @@ TPM2_PolicyAuthorizeNV(PolicyAuthorizeNV_In* in) // Input Validation // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // Skip checks if this is a trial policy if(!session->attributes.isTrialPolicy) @@ -1702,6 +1722,7 @@ TPM2_PolicyCapability(PolicyCapability_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); if(session->attributes.isTrialPolicy == CLEAR) { @@ -1939,6 +1960,7 @@ TPM2_PolicyParameters(PolicyParameters_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // A valid pHash must have the same size as session hash digest // Since the authHashAlg for a session cannot be TPM_ALG_NULL, the digest size diff --git a/src/tpm2/Entity.c b/src/tpm2/Entity.c index 7d38e67e..fe9d8fe8 100644 --- a/src/tpm2/Entity.c +++ b/src/tpm2/Entity.c @@ -1,62 +1,4 @@ -/********************************************************************************/ -/* */ -/* Accessing properties for handles of various types */ -/* Written by Ken Goldman */ -/* IBM Thomas J. Watson Research Center */ -/* */ -/* Licenses and Notices */ -/* */ -/* 1. Copyright Licenses: */ -/* */ -/* - Trusted Computing Group (TCG) grants to the user of the source code in */ -/* this specification (the "Source Code") a worldwide, irrevocable, */ -/* nonexclusive, royalty free, copyright license to reproduce, create */ -/* derivative works, distribute, display and perform the Source Code and */ -/* derivative works thereof, and to grant others the rights granted herein. */ -/* */ -/* - The TCG grants to the user of the other parts of the specification */ -/* (other than the Source Code) the rights to reproduce, distribute, */ -/* display, and perform the specification solely for the purpose of */ -/* developing products based on such documents. */ -/* */ -/* 2. Source Code Distribution Conditions: */ -/* */ -/* - Redistributions of Source Code must retain the above copyright licenses, */ -/* this list of conditions and the following disclaimers. */ -/* */ -/* - Redistributions in binary form must reproduce the above copyright */ -/* licenses, this list of conditions and the following disclaimers in the */ -/* documentation and/or other materials provided with the distribution. */ -/* */ -/* 3. Disclaimers: */ -/* */ -/* - THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF */ -/* LICENSE OR WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH */ -/* RESPECT TO PATENT RIGHTS HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES) */ -/* THAT MAY BE NECESSARY TO IMPLEMENT THIS SPECIFICATION OR OTHERWISE. */ -/* Contact TCG Administration (admin@trustedcomputinggroup.org) for */ -/* information on specification licensing rights available through TCG */ -/* membership agreements. */ -/* */ -/* - THIS SPECIFICATION IS PROVIDED "AS IS" WITH NO EXPRESS OR IMPLIED */ -/* WARRANTIES WHATSOEVER, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR */ -/* FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, OR */ -/* NONINFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS, OR ANY WARRANTY */ -/* OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE. */ -/* */ -/* - Without limitation, TCG and its members and licensors disclaim all */ -/* liability, including liability for infringement of any proprietary */ -/* rights, relating to use of information in this specification and to the */ -/* implementation of this specification, and TCG disclaims all liability for */ -/* cost of procurement of substitute goods or services, lost profits, loss */ -/* of use, loss of data or any incidental, consequential, direct, indirect, */ -/* or special damages, whether under contract, tort, warranty or otherwise, */ -/* arising in any way out of use or reliance upon this specification or any */ -/* information herein. */ -/* */ -/* (c) Copyright IBM Corp. and others, 2016 - 2024 */ -/* */ -/********************************************************************************/ +// SPDX-License-Identifier: BSD-2-Clause //** Description // The functions in this file are used for accessing properties for handles of @@ -149,6 +91,7 @@ EntityGetLoadStatus(COMMAND* command // IN/OUT: command parsing structure { SESSION* session; session = SessionGet(handle); + pAssert_RC(session != NULL); // Check if the session is a HMAC session if(session->attributes.isPolicy == SET) result = TPM_RC_HANDLE; @@ -164,6 +107,7 @@ EntityGetLoadStatus(COMMAND* command // IN/OUT: command parsing structure { SESSION* session; session = SessionGet(handle); + pAssert_RC(session != NULL); // Check if the session is a policy session if(session->attributes.isPolicy == CLEAR) result = TPM_RC_HANDLE; diff --git a/src/tpm2/PolicyTransportSPDM.c b/src/tpm2/PolicyTransportSPDM.c index e51aa48d..c0733b2f 100644 --- a/src/tpm2/PolicyTransportSPDM.c +++ b/src/tpm2/PolicyTransportSPDM.c @@ -27,6 +27,7 @@ TPM2_PolicyTransportSPDM(PolicyTransportSPDM_In* in // IN: input parameter list // Get pointer to the session structure session = SessionGet(in->policySession); + pAssert_RC(session); // Check that TPM2_PolicyTransportSPDM has not previously been executed if(session->attributes.checkSecureChannel == SET) diff --git a/src/tpm2/Session.c b/src/tpm2/Session.c index 1571980e..b3e7d47c 100644 --- a/src/tpm2/Session.c +++ b/src/tpm2/Session.c @@ -306,18 +306,18 @@ SESSION* SessionGet(TPM_HANDLE handle // IN: session handle size_t slotIndex; CONTEXT_SLOT sessionIndex; - pAssert(HandleGetType(handle) == TPM_HT_POLICY_SESSION - || HandleGetType(handle) == TPM_HT_HMAC_SESSION); + pAssert_NULL(HandleGetType(handle) == TPM_HT_POLICY_SESSION + || HandleGetType(handle) == TPM_HT_HMAC_SESSION); slotIndex = handle & HR_HANDLE_MASK; - pAssert(slotIndex < MAX_ACTIVE_SESSIONS); + pAssert_NULL(slotIndex < MAX_ACTIVE_SESSIONS); // get the contents of the session array. Because session is loaded, we // should always get a valid sessionIndex sessionIndex = gr.contextArray[slotIndex] - 1; - pAssert(sessionIndex < MAX_LOADED_SESSIONS); + pAssert_NULL(sessionIndex < MAX_LOADED_SESSIONS); return &s_sessions[sessionIndex].session; } diff --git a/src/tpm2/SessionCommands.c b/src/tpm2/SessionCommands.c index d2f3f96c..3d9deb8f 100644 --- a/src/tpm2/SessionCommands.c +++ b/src/tpm2/SessionCommands.c @@ -168,8 +168,12 @@ TPM2_PolicyRestart( PolicyRestart_In *in // IN: input parameter list ) { + SESSION* session = SessionGet(in->sessionHandle); + pAssert_RC(session != NULL); + // Initialize policy session data - SessionResetPolicyData(SessionGet(in->sessionHandle)); + SessionResetPolicyData(session); + return TPM_RC_SUCCESS; } #endif // CC_PolicyRestart diff --git a/src/tpm2/SessionProcess.c b/src/tpm2/SessionProcess.c index ab53946f..9be9d1c7 100644 --- a/src/tpm2/SessionProcess.c +++ b/src/tpm2/SessionProcess.c @@ -93,6 +93,7 @@ static TPM_RC IncrementLockout(UINT32 sessionIndex) else { session = SessionGet(sessionHandle); + pAssert_RC(session); // If the session is bound to lockout, then use that as the relevant // handle. This means that an authorization failure with a bound session // bound to lockoutAuth will take precedence over any other @@ -107,7 +108,7 @@ static TPM_RC IncrementLockout(UINT32 sessionIndex) } if(handle == TPM_RH_LOCKOUT) { - pAssert(gp.lockOutAuthEnabled == TRUE); + pAssert_RC(gp.lockOutAuthEnabled == TRUE); // lockout is no longer enabled gp.lockOutAuthEnabled = FALSE; @@ -864,6 +865,7 @@ static TPM2B_DIGEST* ComputeCommandHMAC( // Will add the nonce for the decrypt session. SESSION* decryptSession = SessionGet(s_sessionHandles[s_decryptSessionIndex]); + pAssert_RC(decryptSession != NULL); nonceDecrypt = &decryptSession->nonceTPM; } // Now repeat for the encrypt session. @@ -880,6 +882,7 @@ static TPM2B_DIGEST* ComputeCommandHMAC( // Continue with the HMAC processing. session = SessionGet(s_sessionHandles[sessionIndex]); + pAssert_RC(session != NULL); // Generate HMAC key. MemoryCopy2B(&key.b, &session->sessionKey.b, sizeof(key.t.buffer)); @@ -1003,6 +1006,7 @@ static TPM_RC CheckPolicyAuthSession( // // Initialize pointer to the authorization session. session = SessionGet(s_sessionHandles[sessionIndex]); + pAssert_RC(session != NULL); // If the command is TPM2_PolicySecret(), make sure that // either password or authValue is required @@ -1233,6 +1237,7 @@ static TPM_RC RetrieveSessionData( return TPM_RC_REFERENCE_S0 + sessionIndex; sessionType = HandleGetType(s_sessionHandles[sessionIndex]); session = SessionGet(s_sessionHandles[sessionIndex]); + pAssert_RC(session != NULL); // Check if the session is an HMAC/policy session. if((session->attributes.isPolicy == SET && sessionType == TPM_HT_HMAC_SESSION) @@ -1416,6 +1421,7 @@ static TPM_RC CheckAuthSession( if(sessionHandle != TPM_RS_PW) { session = SessionGet(sessionHandle); + pAssert_RC(session != NULL); // Set includeAuth to indicate if DA checking will be required and if the // authValue will be included in any HMAC. @@ -1580,7 +1586,7 @@ ParseSessionBuffer(COMMAND* command // IN: the structure that contains return result; // There is no command in the TPM spec that has more handles than // MAX_SESSION_NUM. - pAssert(command->handleNum <= MAX_SESSION_NUM); + pAssert_RC(command->handleNum <= MAX_SESSION_NUM); // Associate the session with an authorization handle. for(i = 0; i < command->handleNum; i++) @@ -1620,6 +1626,7 @@ ParseSessionBuffer(COMMAND* command // IN: the structure that contains else { session = SessionGet(s_sessionHandles[sessionIndex]); + pAssert_RC(session != NULL); // A trial session can not appear in session area, because it cannot // be used for authorization, audit or encrypt/decrypt. @@ -1658,7 +1665,7 @@ ParseSessionBuffer(COMMAND* command // IN: the structure that contains return TPM_RCS_ATTRIBUTES + errorIndex; // no authValue included in any of the HMAC computations - pAssert(session != NULL); + pAssert_RC(session != NULL); session->attributes.includeAuth = CLEAR; // check HMAC for encrypt/decrypt/audit only sessions @@ -1895,6 +1902,7 @@ static void UpdateAuditSessionStatus( if(s_sessionHandles[i] == TPM_RS_PW) continue; session = SessionGet(s_sessionHandles[i]); + pAssert_VOID_OK(session != NULL); // If a session is used for audit if(IS_ATTRIBUTE(s_attributes[i], TPMA_SESSION, audit)) @@ -2066,6 +2074,8 @@ static TPM2B_NONCE* BuildSingleResponseAuth( { // Fill in policy/HMAC based session response. SESSION* session = SessionGet(s_sessionHandles[sessionIndex]); + pAssert_NULL(session != NULL); + // // If the session is a policy session with isPasswordNeeded SET, the // authorization field is empty. @@ -2094,6 +2104,7 @@ static void UpdateAllNonceTPM(COMMAND* command // IN: controlling structure if(s_sessionHandles[i] != TPM_RS_PW) { session = SessionGet(s_sessionHandles[i]); + pAssert_VOID_OK(session != NULL); // Update nonceTPM in both internal session and response. CryptRandomGenerate(session->nonceTPM.t.size, session->nonceTPM.t.buffer); } @@ -2203,6 +2214,7 @@ BuildResponseSession(COMMAND* command // IN: structure that has relevant comman // Compute the response HMAC and get a pointer to the nonce used. // This function will also update the values if needed. Note, the nonceTPM = BuildSingleResponseAuth(command, i, &responseAuth); + pAssert_RC(nonceTPM != NULL); } command->authSize += TPM2B_NONCE_Marshal(nonceTPM, &command->responseBuffer, NULL);