Bound fwTPM child blob sizes before copying from the response

[aidangarske]

CID 913517

[Copilot]

🟡 Changes recommended

The new bounds checks still don’t assert that the response buffer (rspSize) actually contains the claimed blob lengths before reading/copying, which can cause reads past the valid response payload.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens fwTPM unit test parsing of TPM Create responses by adding upper-bound assertions before copying child key blobs, aiming to prevent oversized blob lengths from overflowing the caller-provided buffers.

Changes:

• Added a new AssertIntLE() helper macro for “less-than-or-equal” integer assertions.
• Added bounds checks to ensure outPrivate.size and outPublic (size-prefix + data) fit into the caller buffers before memcpy() in CreateChildBlobs().

File summaries

File	Description
tests/fwtpm_unit_tests.c	Adds assertions to bound parsed child blob sizes before copying them out of the TPM response in fwTPM unit tests.

Review details

Suppressed comments (1)

tests/fwtpm_unit_tests.c:10548

• CreateChildBlobs() reads/copies outPublic using *pubSz from the response, but does not assert the response length (rspSize) covers the size field and the subsequent 2+pubSz bytes. This can read beyond the valid response and copy uninitialized/stale bytes from gRsp into pub.

    *pubSz = GetU16BE(gRsp + pos);
    AssertIntGT(*pubSz, 0);
    AssertIntLE(2 + *pubSz, sizeof(TPM2B_PUBLIC));    /* fits caller's buffer */
    memcpy(pub, gRsp + pos, 2 + *pubSz);              /* keep the size prefix */

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.