User-Agent: K-9 Mail for Android
In-Reply-To: <20150609113913.GA1079@jsakkine-mobl1>
References: <1433349555-30868-1-git-send-email-jarkko.sakkinen@linux.intel.com> <201506082239.33639.PeterHuewe@gmx.de> <20150609091932.GC4968@jsakkine-mobl1> <1C403FBE-76FF-425C-8627-5956838CD560@gmx.de> <20150609113913.GA1079@jsakkine-mobl1>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 8BIT
Subject: Re: [tpmdd-devel] [PATCH v2] tpm: introduce struct tpm_buf
From: Peter Huewe <peterhuewe@gmx.de>
Date: Tue, 09 Jun 2015 13:58:59 +0200
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
CC: "moderated list:TPM DEVICE DRIVER" 
	<tpmdd-devel@lists.sourceforge.net>,
        safford@us.ibm.com, open list <linux-kernel@vger.kernel.org>
Message-ID: <41179E5D-88E5-46B0-BEB8-6D759F917BDD@gmx.de>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1683
Lines: 51


Am 9. Juni 2015 13:39:13 MESZ, schrieb Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>:
>On Tue, Jun 09, 2015 at 12:32:57PM +0200, Peter Huewe wrote:
>> 
>> 
>> Hi
>> 
>> >> > +static inline void tpm_buf_store(struct tpm_buf *buf,
>> >> > +				 unsigned int pos,
>> >> > +				 const unsigned char *data,
>> >> > +				 unsigned int len)
>> >> > +{
>> >> > +	BUG_ON((pos + len) > TPM_BUF_SIZE);
>> >> > +
>> >> > +	memcpy(&buf->data[pos], data, len);
>> >> > +}
>> >> 
>> >> Don't you have to update the ->length here?
>> >
>> >No. Store is for placing value in position, not appending to the
>end.
>> >
>> Then either add a length check (whether ->length is big enough)
>and/or
>> call the function "update"
>
>There is a length check in the beginning (first line of the function
>body).
>
Nope.
The check in the first line checks whether the write is <= the max buffer size, 
but not <= head->length.

Since head->length is not updated (as per design) it is possible to write data without effect using this function. 
This is not what I expect from an API.


Example I create a buffer using tpm_buf_append with 12 bytes, so head->length == 12
Then I use tpm_buf_store at pos 10 and len 4 --> in the buffer are 14 bytes, but tpm_buf_length will only report 12 bytes.

Which is not what I would expect and your current check dies not prevent this.

Peter
-- 
Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/