Backport a few patches for v0.10.3 - #613
Conversation
Cast size_t i to ssize_t i to check for underrun. An underrun could never occur since it is not possible that all commands are disabled. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
When rolling back after an unsuccessful switch to the new attributes/algorithms/commands profile, use the maximum possible StateFormatLevel value to set the old profile. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Rather than asserting, display an error log message in case an ANY_OBJECT could not be unmarshalled. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Check the untrusted array_size of AuditCommandList and PPList against a reasonable maximum value of 1024. Artificially setting BYTE buf[0xffff], which would be the maximum value array_size could get with the unmarshalling, does not cause any issues (crash due to large on-stack buffer) on my Linux system. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Limit the size of a profile to 32kb. There is no reason that a valid profile would have even close to 32kb. This also prevents issues in String_Marshal() that assumes a reasonably sized string below 64kb. Place the check for the size of the profile into GetParametersFromJSON since this function is used by RuntimeProfileSet and RuntimeProfileTest. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (7)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📝 WalkthroughWalkthroughThe changes add bounds checks for unmarshalled data and JSON profiles, propagate NVRAM object errors, correct ECC validation gating, preserve previous runtime profiles during rollback, and fix reverse scanning of enabled commands. ChangesTPM validation and profile handling
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to This backport adds input bounds checks, propagates unmarshalling failures, preserves prior profiles during rollback, and corrects command scanning and ECC validation gating. No concrete current-head merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Check for rc == TPM_RC_SUCCESS before calling function to check whether the EC algorithm is allowed by the profile. This is necessary since rc could already have been set to TPM_RC_CURVE before. In case the function call failed, it would again be set to TPM_RC_CURVE, which is unnecessary. Also do not call the function when TPM_ECC_NONE was unmarshalled since this would always fail and unmarshalling TPM_ECC_NONE would never work. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
1467875 to
5668fde
Compare
1 participant
Backport a few patches to v0.10.3.
Summary by CodeRabbit