[xen master] vtpmmgr: Check req_len before unpacking command

[patchbot@xxxxxxx]

commit 5974702bddd37445ae2104f567d88c400227d5d4
Author:     Jason Andryuk <jandryuk@xxxxxxxxx>
AuthorDate: Thu May 6 09:59:22 2021 -0400
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Mon May 10 14:50:33 2021 +0100

    vtpmmgr: Check req_len before unpacking command
    
    vtpm_handle_cmd doesn't ensure there is enough space before unpacking
    the req buffer.  Add a minimum size check.  Called functions will have
    to do their own checking if they need more data from the request.
    
    The error case is tricky since abort_egress wants to rely with a
    corresponding tag.  Just hardcode TPM_TAG_RQU_COMMAND since the vtpm is
    sending in malformed commands in the first place.
    
    Signed-off-by: Jason Andryuk <jandryuk@xxxxxxxxx>
    Reviewed-by: Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>
    Reviewed-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
---
 stubdom/vtpmmgr/vtpm_cmd_handler.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/stubdom/vtpmmgr/vtpm_cmd_handler.c 
b/stubdom/vtpmmgr/vtpm_cmd_handler.c
index c879b24c13..5586be6997 100644
--- a/stubdom/vtpmmgr/vtpm_cmd_handler.c
+++ b/stubdom/vtpmmgr/vtpm_cmd_handler.c
@@ -840,6 +840,12 @@ TPM_RESULT vtpmmgr_handle_cmd(
        UINT32 size;
        TPM_COMMAND_CODE ord;
 
+       if (tpmcmd->req_len < sizeof_TPM_RQU_HEADER(tpmcmd->req)) {
+               status = TPM_BAD_PARAMETER;
+               tag = TPM_TAG_RQU_COMMAND;
+               goto abort_egress;
+       }
+
        unpack_TPM_RQU_HEADER(tpmcmd->req,
                        &tag, &size, &ord);
 
--
generated by git-patchbot for /home/xen/git/xen.git#master