summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaisuke Nojiri <dnojiri@chromium.org>2014-05-02 10:36:43 -0700
committerMarc Jones <marc.jones@se-eng.com>2014-12-30 22:44:24 +0100
commitafde961adfcba92b30b422b8eb681d91c257de34 (patch)
treeaae7425d3bef2cfab8d4702fb8d02de44a5f9209
parent704c006479428db9133ce3d7024af8c0fa5a8ce5 (diff)
downloadcoreboot-afde961adfcba92b30b422b8eb681d91c257de34.tar.xz
vboot: Convert response_length from uint32_t to size_t in VbExTpmSendReceive
Length arguments for VbExTpmSendReceive have type uint32_t but it calls function which expects size_t. This change converts uint32_t to size_t on call and size_t to uint32_t on return. BUG=None BRANCH=None TEST=Booted Nyan Big to Linux Original-Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Original-Change-Id: I1971488baae2d060c0cddec7749461c91602a4f9 Original-Reviewed-on: https://chromium-review.googlesource.com/198016 (cherry picked from commit 6830747eb47568f2a2b494624522d37d8945c030) Signed-off-by: Marc Jones <marc.jones@se-eng.com> Change-Id: I20741759e7bbd60dd7044c532287d6b55047e19a Reviewed-on: http://review.coreboot.org/7894 Tested-by: build bot (Jenkins) Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
-rw-r--r--src/vendorcode/google/chromeos/vboot_wrapper.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/src/vendorcode/google/chromeos/vboot_wrapper.c b/src/vendorcode/google/chromeos/vboot_wrapper.c
index 5611451654..5aa0066944 100644
--- a/src/vendorcode/google/chromeos/vboot_wrapper.c
+++ b/src/vendorcode/google/chromeos/vboot_wrapper.c
@@ -225,9 +225,13 @@ VbError_t VbExTpmOpen(void)
VbError_t VbExTpmSendReceive(const uint8_t *request, uint32_t request_length,
uint8_t *response, uint32_t *response_length)
{
- if (gcontext->tis_sendrecv(request, request_length,
- response, response_length))
+ size_t len = *response_length;
+ if (gcontext->tis_sendrecv(request, request_length, response, &len))
return VBERROR_UNKNOWN;
+ /* check 64->32bit overflow and (re)check response buffer overflow */
+ if (len > *response_length)
+ return VBERROR_UNKNOWN;
+ *response_length = len;
return VBERROR_SUCCESS;
}