mbox series

[U-Boot,0/3] Fix potential buffer overruns in TPM driver

Message ID 1518476197-24517-1-git-send-email-jeremy.boone@gmail.com
Headers show
Series Fix potential buffer overruns in TPM driver | expand

Message

Jeremy Boone Feb. 12, 2018, 10:56 p.m. UTC 
From: Jeremy Boone <jeremy.boone@nccgroup.trust>

The TPM response packet often contains a variable-length payload. It is
the responsibility of U-Boot driver code to ensure that the length value
that has been extracted from the response packet's header or body is
appropriately sized before copying that data into another buffer.

Jeremy Boone (3):
  STMicro TPM: Fix potential buffer overruns
  Infineon TPM: Fix potential buffer overruns
  Atmel TPM: Fix potential buffer overruns

 drivers/tpm/tpm_atmel_twi.c        | 14 ++++++++++++--
 drivers/tpm/tpm_tis_infineon.c     |  5 +++--
 drivers/tpm/tpm_tis_st33zp24_i2c.c |  5 +++--
 drivers/tpm/tpm_tis_st33zp24_spi.c |  5 +++--
 4 files changed, 21 insertions(+), 8 deletions(-)