Backport a few patches for v0.7.13

configure.ac

@@ -3,7 +3,7 @@
 #
 # See the LICENSE file for the license associated with this file.
 
-AC_INIT([libtpms],[0.7.11])
+AC_INIT([libtpms],[0.7.13])
 AC_PREREQ([2.69])
 AC_CONFIG_SRCDIR(Makefile.am)
 AC_CONFIG_AUX_DIR([.])

dist/libtpms.spec

@@ -1,7 +1,7 @@
 # --- libtpm rpm-spec ---
 
 %define name      libtpms
-%define version   0.7.11
+%define version   0.7.13
 %define release   0
 
 # Valid crypto subsystems are 'freebl' and 'openssl'

include/libtpms/tpm_library.h

@@ -50,7 +50,7 @@ extern "C" {
 
 #define TPM_LIBRARY_VER_MAJOR 0
 #define TPM_LIBRARY_VER_MINOR 7
-#define TPM_LIBRARY_VER_MICRO 11
+#define TPM_LIBRARY_VER_MICRO 13
 
 #define TPM_LIBRARY_VERSION_GEN(MAJ, MIN, MICRO) \
     (( MAJ << 16 ) | ( MIN << 8 ) | ( MICRO ))

src/tpm12/tpm_crypto.c

@@ -2138,6 +2138,20 @@ TPM_RESULT TPM_Sha1Context_Load(void **context,
     if ((rc== 0) && contextPresent) {
 	rc = TPM_Load32(&(sha_ctx->num), stream, stream_size);
     }
+    /* 'num' is the number of bytes buffered in sha_ctx->data and is used by
+       OpenSSL as the write offset in SHA1_Update()/SHA1_Final(); it must be
+       less than the block size, else a later update walks off the context. */
+    if ((rc== 0) && contextPresent) {
+	if (sha_ctx->num >= SHA_CBLOCK) {
+	    printf("TPM_Sha1Context_Load: Error, num %u out of range\n",
+		   sha_ctx->num);
+	    rc = TPM_BAD_PARAMETER;
+	}
+    }
+    if ((rc != 0) && contextPresent && (*context != NULL)) {
+	free(*context);
+	*context = NULL;
+    }
     return rc;
 }
 
@@ -2864,9 +2878,10 @@ TPM_RESULT TPM_SymmetricKeyData_Decrypt(unsigned char **decrypt_data,   /* outpu
 	(TPM_SYMMETRIC_KEY_DATA *)tpm_symmetric_key_token;
 
     printf(" TPM_SymmetricKeyData_Decrypt: Length %u\n", encrypt_length);
-    /* sanity check encrypted length */
+    /* sanity check encrypted length; CBC requires a whole number of blocks,
+       otherwise AES_cbc_encrypt() reads past the end of the input buffer */
     if (rc == 0) {
-        if (encrypt_length < TPM_AES_BLOCK_SIZE) {
+        if ((encrypt_length % TPM_AES_BLOCK_SIZE) != 0) {
             printf("TPM_SymmetricKeyData_Decrypt: Error, bad length\n");
             rc = TPM_DECRYPT_ERROR;
         }

src/tpm12/tpm_crypto_freebl.c

@@ -2323,9 +2323,9 @@ TPM_RESULT TPM_SymmetricKeyData_Decrypt(unsigned char **decrypt_data,   /* outpu
     printf(" TPM_SymmetricKeyData_Decrypt: Length %u\n", encrypt_length);
     cx = NULL;    /* freed @1 */
 
-    /* sanity check encrypted length */
+    /* sanity check encrypted length; CBC requires a whole number of blocks */
     if (rc == 0) {
-        if (encrypt_length < TPM_AES_BLOCK_SIZE) {
+        if ((encrypt_length % TPM_AES_BLOCK_SIZE) != 0) {
             printf("TPM_SymmetricKeyData_Decrypt: Error, bad length\n");
             rc = TPM_DECRYPT_ERROR;
         }

src/tpm2/Object.c

@@ -75,6 +75,7 @@ ObjectFlush(
 	    OBJECT          *object
 	    )
 {
+    MemorySet(object, 0, sizeof(*object));
     object->attributes.occupied = CLEAR;
 }
 /* 8.6.3.2 ObjectSetInUse() */

src/tpm2/Unmarshal.c

@@ -48,7 +48,7 @@
 TPM_RC
 UINT8_Unmarshal(UINT8 *target, BYTE **buffer, INT32 *size)
 {
-    if ((UINT32)*size < sizeof(UINT8)) {
+    if (*size < 0 || (UINT32)*size < sizeof(UINT8)) {
 	return TPM_RC_INSUFFICIENT;
     }
     *target = (*buffer)[0];
@@ -66,7 +66,7 @@ INT8_Unmarshal(INT8 *target, BYTE **buffer, INT32 *size)
 TPM_RC
 UINT16_Unmarshal(UINT16 *target, BYTE **buffer, INT32 *size)
 {
-    if ((UINT32)*size < sizeof(UINT16)) {
+    if (*size < 0 || (UINT32)*size < sizeof(UINT16)) {
 	return TPM_RC_INSUFFICIENT;
     }
     *target = ((UINT16)((*buffer)[0]) << 8) |
@@ -79,7 +79,7 @@ UINT16_Unmarshal(UINT16 *target, BYTE **buffer, INT32 *size)
 TPM_RC
 UINT32_Unmarshal(UINT32 *target, BYTE **buffer, INT32 *size)
 {
-    if ((UINT32)*size < sizeof(UINT32)) {
+    if (*size < 0 || (UINT32)*size < sizeof(UINT32)) {
 	return TPM_RC_INSUFFICIENT;
     }
     *target = ((UINT32)((*buffer)[0]) << 24) |
@@ -94,7 +94,7 @@ UINT32_Unmarshal(UINT32 *target, BYTE **buffer, INT32 *size)
 TPM_RC
 UINT64_Unmarshal(UINT64 *target, BYTE **buffer, INT32 *size)
 {
-    if ((UINT32)*size < sizeof(UINT64)) {
+    if (*size < 0 || (UINT32)*size < sizeof(UINT64)) {
 	return TPM_RC_INSUFFICIENT;
     }
     *target = ((UINT64)((*buffer)[0]) << 56) |
@@ -115,7 +115,7 @@ Array_Unmarshal(BYTE *targetBuffer, UINT16 targetSize, BYTE **buffer, INT32 *siz
 {
     TPM_RC rc = TPM_RC_SUCCESS;
 
-    if (targetSize > *size) {
+    if (*size < 0 || targetSize > (UINT32)*size) {
 	rc = TPM_RC_INSUFFICIENT;
     }
     else {

src/tpm2/crypto/openssl/CryptRsa.c

@@ -67,9 +67,10 @@
 /* Need this define to get the private defines for this function */
 #define CRYPT_RSA_C
 #include "Tpm.h"
-#include "Helpers_fp.h"  // libtpms added
+#include "Helpers_fp.h"		// libtpms added begin
 
-#include <openssl/rsa.h> // libtpms added
+#include <openssl/rsa.h>
+#include <openssl/crypto.h>	// libtpms added end
 
 #if ALG_RSA
 /* 10.2.19.3 Obligatory Initialization Functions */
@@ -364,17 +365,21 @@ OaepDecode(
 	   TPM2B           *padded         // IN: the padded data
 	   )
 {
-    UINT32       i;
+    UINT32       i, j, k, l;
     BYTE         seedMask[MAX_DIGEST_SIZE];
     UINT32       hLen = CryptHashGetDigestSize(hashAlg);
     BYTE         mask[MAX_RSA_KEY_BYTES];
     BYTE        *pp;
     BYTE        *pm;
     TPM_RC       retVal = TPM_RC_SUCCESS;
+    BOOL         bad = FALSE;
+    NUMBYTES     sizemask;
     // Strange size (anything smaller can't be an OAEP padded block)
     // Also check for no leading 0
-    if((padded->size < (unsigned)((2 * hLen) + 2)) || (padded->buffer[0] != 0))
+    // padded->size should be the size of an RSA public key (128/256/384)
+    if(padded->size < (unsigned)((2 * hLen) + 2))
 	ERROR_RETURN(TPM_RC_VALUE);
+    bad |= (padded->buffer[0] != 0);
     // Use the hash size to determine what to put through MGF1 in order
     // to recover the seedMask
     CryptMGF1(hLen, seedMask, hashAlg, padded->size - hLen - 1,
@@ -397,29 +402,46 @@ OaepDecode(
     if((CryptHashBlock(hashAlg, label->size, (BYTE *)label->buffer,
 		       hLen, seedMask)) != hLen)
 	FAIL(FATAL_ERROR_INTERNAL);
-    if(memcmp(seedMask, mask, hLen) != 0)
-	ERROR_RETURN(TPM_RC_VALUE);
-    // find the start of the data
+    bad |= (CRYPTO_memcmp(seedMask, mask, hLen) != 0);
+    // find the start of the data in constant-time (continue loop once found)
     pm = &mask[hLen];
-    for(i = (UINT32)padded->size - (2 * hLen) - 1; i > 0; i--)
-	{
-	    if(*pm++ != 0)
-		break;
-	}
+    i = 0;
+    for(l = (UINT32)padded->size - (2 * hLen) - 1; l > 0; l--)
+    {
+        UINT32 is_nonzero = (*pm != 0);  // 0 or 1
+        UINT32 not_found_yet = (i == 0); // 1 if we haven't found a non-zero yet
+        // Latch position on first non-zero: if is_nonzero AND not_found_yet, set j = i
+        i |= (l & (0 - (is_nonzero & not_found_yet)));
+        pm++;
+    }
+    // adjust pm according to 'i'; we would have left the loop once (*pm++ != 0)
+    pm = &mask[(UINT32)padded->size - hLen - i];
     // If we ran out of data or didn't end with 0x01, then return an error
-    if(i == 0 || pm[-1] != 0x01)
-	ERROR_RETURN(TPM_RC_VALUE);
+    bad |= i == 0;
+    // pm is at least at offset of hLen + 1 into mask => pm[-1] will not be out-of-bounds
+    bad |= pm[-1] != 0x01;
+
     // pm should be pointing at the first part of the data
     // and i is one greater than the number of bytes to move
-    i--;
-    if(i > dataOut->size)
-	// Special exit to preserve the size of the output buffer
-	return TPM_RC_VALUE;
+    i -= (i > 0);
+    bad |= i > dataOut->size;
+
+    // Limit i to dataOut->size;
+    j = i;
+    k = dataOut->size;
+    if(i > k)
+        i = k;
+    else
+        i = j;
+
     memcpy(dataOut->buffer, pm, i);
     dataOut->size = (UINT16)i;
+    retVal = bad ? TPM_RC_VALUE : TPM_RC_SUCCESS;
+
  Exit:
-    if(retVal != TPM_RC_SUCCESS)
-	dataOut->size = 0;
+    sizemask = retVal != TPM_RC_SUCCESS ? 0 : ~0;
+    dataOut->size &= sizemask;
+
     return retVal;
 }
 /* 10.2.19.4.7 PKCS1v1_5Encode() */

src/tpm_library.c

@@ -415,7 +415,7 @@ static unsigned char *TPMLIB_GetPlaintext(const char *stream,
                                           const char *endtag,
                                           size_t *length)
 {
-    char *start, *end;
+    const char *start, *end;
     unsigned char *plaintext = NULL;
 
     start = strstr(stream, starttag);