From ec21a8bfdac9ca320e58372c6ebb90d2d8644e80 Mon Sep 17 00:00:00 2001 From: Stefan Berger Date: Mon, 9 Mar 2026 16:17:02 -0400 Subject: [PATCH] tpm2: Use marshalled size of OBJECT to see whether it fits into NVRAM Use the marshalled size of an OBJECT to check whether it still fits into NVRAM rather than using the size of the OBJECT (sizeof(obj), which is much bigger. Using the marshalled size also handles the case where the OBJECT is still copied into NVRAM using memcpy for the NULL profile case of libtpms v0.9. This should have been converted once NvObjectToBuffer() was started to be called there. Signed-off-by: Stefan Berger --- src/tpm2/NVMarshal.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c index 781a5e57..fef13a19 100644 --- a/src/tpm2/NVMarshal.c +++ b/src/tpm2/NVMarshal.c @@ -4982,12 +4982,10 @@ USER_NVRAM_Unmarshal(BYTE **buffer, INT32 *size) break; case TPM_HT_PERSISTENT: if (rc == TPM_RC_SUCCESS && - o + offset + sizeof(TPM_HANDLE) + sizeof(obj) > - array_size) { - o += offset + sizeof(TPM_HANDLE) + sizeof(obj); + o + offset + sizeof(TPM_HANDLE) > array_size) { + o += offset + sizeof(TPM_HANDLE); goto exit_size; } - if (rc == TPM_RC_SUCCESS) { BYTE objBuffer[MAX_MARSHALLED_OBJECT_SIZE]; UINT32 marshalledObjectSize; @@ -5000,6 +4998,11 @@ USER_NVRAM_Unmarshal(BYTE **buffer, INT32 *size) pAssert(rc == TPM_RC_SUCCESS); // convert the OBJECT into a buffer to copy into NVRAM marshalledObjectSize = NvObjectToBuffer(&obj, objBuffer, sizeof(objBuffer)); + + if (o + offset + marshalledObjectSize > array_size) { + o += offset + marshalledObjectSize; + goto exit_size; + } NvWrite(entryRef + o + offset, marshalledObjectSize, objBuffer); offset += marshalledObjectSize;