Simon, On 28.07.26 20:41, Simon Glass wrote:
This bounds the copy against a size derived from prop_count, not against the real size of buf, which the function is never told. It is safe today only because every caller happens to pass a buffer of at least sizeof(u32) + prop_count * sizeof(struct tpms_tagged_property) bytes. The kerneldoc does not spell that out - it describes @prop_count only as 'Size of output buffer', which reads as a byte count rather than a property count:@prop_count Size of output buffer So the memcpy() safety rests on an undocumented contract. Since you are hardening this path, please can you pass the caller's actual buffer length and bound the copy against that, and document what @prop_count means? That also sidesteps what the bound should be for capabilities other than TPM2_CAP_TPM_PROPERTIES, where the copy is still unbounded. What do you think? Regards, Simon
Right, v4 gives tpm2_get_capability() a buf_size argument and bounds the copy against it for every capability, the TPM2_CAP_TPM_PROPERTIES special-case is gone.
Thanks, Shah
