Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix responder_chunk_send buffer overflow #2640

Merged
merged 6 commits into from
Mar 30, 2024
Merged

fix responder_chunk_send buffer overflow #2640

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7dd4c5f
Add message size check for the first chunk of chunk_send_request.
jyao1 Mar 27, 2024
962736b
Add minimal chunk_size check for chunk_send_request, align with chunk…
jyao1 Mar 27, 2024
92ccb29
Add minimal large message check.
jyao1 Mar 27, 2024
3eef8d6
Avoid recursive SPDM_CHUNK_SEND.
jyao1 Mar 27, 2024
703d07a
Improve readability of calc_max_chunk_size calculation
jyao1 Mar 27, 2024
a095447
remove invalid unit test for algorithm chunk.
jyao1 Mar 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion library/spdm_requester_lib/libspdm_req_handle_error_response.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/**
* Copyright Notice:
* Copyright 2021-2022 DMTF. All rights reserved.
* Copyright 2021-2024 DMTF. All rights reserved.
* License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md
**/

Expand Down Expand Up @@ -346,6 +346,10 @@ libspdm_return_t libspdm_handle_error_large_response(
status = LIBSPDM_STATUS_INVALID_MSG_FIELD;
break;
}
if (large_response_size <= SPDM_MIN_DATA_TRANSFER_SIZE_VERSION_12) {
status = LIBSPDM_STATUS_INVALID_MSG_FIELD;
break;
}
} else {
if (response_size < sizeof(spdm_chunk_response_response_t)) {
status = LIBSPDM_STATUS_INVALID_MSG_SIZE;
Expand Down
27 changes: 22 additions & 5 deletions library/spdm_responder_lib/libspdm_rsp_chunk_send_ack.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,15 +92,27 @@ libspdm_return_t libspdm_get_response_chunk_send(libspdm_context_t *spdm_context

if (!send_info->chunk_in_use) {

if (request_size < sizeof(spdm_chunk_send_request_t) + sizeof(uint32_t)) {
libspdm_generate_error_response(
spdm_context, SPDM_ERROR_CODE_INVALID_REQUEST, 0,
response_size, response);
return LIBSPDM_STATUS_SUCCESS;
}

large_message_size = *(const uint32_t*) (spdm_request + 1);
chunk = (((const uint8_t*) (spdm_request + 1)) + sizeof(uint32_t));
calc_max_chunk_size =
((uint32_t)request_size - (uint32_t)(chunk - (const uint8_t*) spdm_request));
(uint32_t)request_size - (sizeof(spdm_chunk_send_request_t) + sizeof(uint32_t));

if (spdm_request->chunk_seq_no != 0
|| (spdm_request->chunk_size
< SPDM_MIN_DATA_TRANSFER_SIZE_VERSION_12
- sizeof(spdm_chunk_send_request_t)
- sizeof(uint32_t))
|| spdm_request->chunk_size > calc_max_chunk_size
|| (uint32_t)request_size > spdm_context->local_context.capability.data_transfer_size
|| large_message_size > spdm_context->local_context.capability.max_spdm_msg_size
|| large_message_size <= SPDM_MIN_DATA_TRANSFER_SIZE_VERSION_12
|| (spdm_request->header.param1 & SPDM_CHUNK_SEND_REQUEST_ATTRIBUTE_LAST_CHUNK)
) {
status = LIBSPDM_STATUS_INVALID_MSG_FIELD;
Expand All @@ -127,7 +139,7 @@ libspdm_return_t libspdm_get_response_chunk_send(libspdm_context_t *spdm_context

chunk = (const uint8_t*) (spdm_request + 1);
calc_max_chunk_size =
((uint32_t)request_size - (uint32_t) (chunk - (const uint8_t *) spdm_request));
(uint32_t)request_size - sizeof(spdm_chunk_send_request_t);

if (spdm_request->chunk_seq_no != send_info->chunk_seq_no + 1
|| spdm_request->header.param2 != send_info->chunk_handle
Expand All @@ -142,6 +154,9 @@ libspdm_return_t libspdm_get_response_chunk_send(libspdm_context_t *spdm_context
} else if (!(spdm_request->header.param1 & SPDM_CHUNK_SEND_REQUEST_ATTRIBUTE_LAST_CHUNK)
&& ((spdm_request->chunk_size + send_info->chunk_bytes_transferred
> send_info->large_message_size)
|| (spdm_request->chunk_size
< SPDM_MIN_DATA_TRANSFER_SIZE_VERSION_12
- sizeof(spdm_chunk_send_request_t))
|| ((uint32_t) request_size
> spdm_context->local_context.capability.data_transfer_size))) {
status = LIBSPDM_STATUS_INVALID_MSG_FIELD;
Expand Down Expand Up @@ -196,12 +211,14 @@ libspdm_return_t libspdm_get_response_chunk_send(libspdm_context_t *spdm_context
send_info->large_message = NULL;
send_info->large_message_size = 0;
} else if (send_info->chunk_bytes_transferred == send_info->large_message_size) {
uint8_t opcode;

opcode = ((spdm_message_header_t*)send_info->large_message)->request_response_code;
libspdm_get_spdm_response_func response_func =
libspdm_get_response_func_via_request_code(
((spdm_message_header_t*)send_info->large_message)->request_response_code);
libspdm_get_response_func_via_request_code(opcode);

if (response_func != NULL) {
if ((response_func != NULL) &&
(opcode != SPDM_CHUNK_SEND) && (opcode != SPDM_CHUNK_GET)) {
status = response_func(
spdm_context,
send_info->large_message_size, send_info->large_message,
Expand Down
77 changes: 0 additions & 77 deletions unit_test/test_spdm_requester/chunk_get.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -259,31 +259,6 @@ void libspdm_requester_chunk_get_test_case4_build_digest_response(
spdm_response->header.param2 |= (0xFF << 0);
}

void libspdm_requester_chunk_get_test_case5_build_algorithms_response(
void* context, void* response, size_t* response_size)
{
spdm_algorithms_response_t* spdm_response;

*response_size = sizeof(spdm_algorithms_response_t);
spdm_response = (spdm_algorithms_response_t*) response;

libspdm_zero_mem(spdm_response, *response_size);
spdm_response->header.spdm_version = SPDM_MESSAGE_VERSION_12;
spdm_response->header.request_response_code = SPDM_ALGORITHMS;
spdm_response->header.param1 = 0;
spdm_response->header.param2 = 0;
spdm_response->length = sizeof(spdm_algorithms_response_t);
spdm_response->measurement_specification_sel =
SPDM_MEASUREMENT_SPECIFICATION_DMTF;
spdm_response->measurement_hash_algo =
m_libspdm_use_measurement_hash_algo;
spdm_response->base_asym_sel = m_libspdm_use_asym_algo;
spdm_response->base_hash_sel = m_libspdm_use_hash_algo;
spdm_response->ext_asym_sel_count = 0;
spdm_response->ext_hash_sel_count = 0;
}


libspdm_return_t libspdm_requester_chunk_get_test_send_message(
void* spdm_context, size_t request_size, const void* request,
uint64_t timeout)
Expand Down Expand Up @@ -456,9 +431,6 @@ libspdm_return_t libspdm_requester_chunk_get_test_receive_message(
} else if (spdm_test_context->case_id == 0x4) {
build_response_func =
libspdm_requester_chunk_get_test_case4_build_digest_response;
} else if (spdm_test_context->case_id == 0x5) {
build_response_func =
libspdm_requester_chunk_get_test_case5_build_algorithms_response;
} else {
LIBSPDM_ASSERT(0);
return LIBSPDM_STATUS_RECEIVE_FAIL;
Expand Down Expand Up @@ -860,52 +832,6 @@ void libspdm_test_requester_chunk_get_case4(void** state)
}
#endif

void libspdm_test_requester_chunk_get_case5(void** state)
{
/* Copied from Neg. Algorithms test case 2 */
libspdm_return_t status;
libspdm_test_context_t* spdm_test_context;
libspdm_context_t* spdm_context;

spdm_test_context = *state;
spdm_context = spdm_test_context->spdm_context;
spdm_test_context->case_id = 0x5;
spdm_context->connection_info.version = SPDM_MESSAGE_VERSION_12 <<
SPDM_VERSION_NUMBER_SHIFT_BIT;
spdm_context->connection_info.connection_state =
LIBSPDM_CONNECTION_STATE_AFTER_CAPABILITIES;
spdm_context->connection_info.capability.flags |=
(SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_CERT_CAP
| SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_CHUNK_CAP);

spdm_context->local_context.capability.flags |=
SPDM_GET_CAPABILITIES_REQUEST_FLAGS_CHUNK_CAP;
spdm_context->local_context.capability.data_transfer_size
= CHUNK_GET_REQUESTER_UNIT_TEST_DATA_TRANSFER_SIZE;
spdm_context->connection_info.capability.flags |= SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_MEAS_CAP;
spdm_context->local_context.algorithm.measurement_spec = SPDM_MEASUREMENT_SPECIFICATION_DMTF;

spdm_context->local_context.algorithm.measurement_hash_algo =
m_libspdm_use_measurement_hash_algo;
spdm_context->local_context.algorithm.base_asym_algo = m_libspdm_use_asym_algo;
spdm_context->local_context.algorithm.base_hash_algo = m_libspdm_use_hash_algo;
spdm_context->local_context.algorithm.dhe_named_group = m_libspdm_use_dhe_algo;
spdm_context->local_context.algorithm.aead_cipher_suite = m_libspdm_use_aead_algo;
spdm_context->local_context.algorithm.req_base_asym_alg = m_libspdm_use_req_asym_algo;
spdm_context->local_context.algorithm.key_schedule = m_libspdm_use_key_schedule_algo;
libspdm_reset_message_a(spdm_context);

status = libspdm_negotiate_algorithms(spdm_context);
assert_int_equal(status, LIBSPDM_STATUS_SUCCESS);
#if LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT
assert_int_equal(
spdm_context->transcript.message_a.buffer_size,
sizeof(spdm_negotiate_algorithms_request_t) +
4 * sizeof(spdm_negotiate_algorithms_common_struct_table_t) +
sizeof(spdm_algorithms_response_t));
#endif
}

libspdm_test_context_t m_libspdm_requester_chunk_get_test_context = {
LIBSPDM_TEST_CONTEXT_VERSION,
true,
Expand Down Expand Up @@ -933,9 +859,6 @@ int libspdm_requester_chunk_get_test_main(void)
/* Request Digests */
cmocka_unit_test(libspdm_test_requester_chunk_get_case4),
#endif

/* Request Algorithms */
cmocka_unit_test(libspdm_test_requester_chunk_get_case5),
};

libspdm_setup_test_context(
Expand Down
Loading