From: Jeremy Boone <jeremy.boone@nccgroup.trust> The TPM response packet often contains a variable-length payload. It is the responsibility of U-Boot driver code to ensure that the length value that has been extracted from the response packet's header or body is appropriately sized before copying that data into another buffer.
Jeremy Boone (3): STMicro TPM: Fix potential buffer overruns Infineon TPM: Fix potential buffer overruns Atmel TPM: Fix potential buffer overruns drivers/tpm/tpm_atmel_twi.c | 14 ++++++++++++-- drivers/tpm/tpm_tis_infineon.c | 5 +++-- drivers/tpm/tpm_tis_st33zp24_i2c.c | 5 +++-- drivers/tpm/tpm_tis_st33zp24_spi.c | 5 +++-- 4 files changed, 21 insertions(+), 8 deletions(-) -- 2.7.4 _______________________________________________ U-Boot mailing list U-Boot@lists.denx.de https://lists.denx.de/listinfo/u-boot
