Skip to content

Commit 984ee1f

Browse files
danielinuxdanielinux
committed
Fix store header search bounds
F/1472
1 parent ae7d23b commit 984ee1f

4 files changed

Lines changed: 70 additions & 4 deletions

File tree

‎src/pkcs11_store.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,7 @@ static uint8_t *find_object_buffer(int32_t type, uint32_t tok_id, uint32_t obj_i
244244
{
245245
struct obj_hdr *hdr = NODES_TABLE;
246246
uint32_t *tok_obj_stored = NULL;
247-
while ((uintptr_t)hdr < ((uintptr_t)NODES_TABLE + WOLFBOOT_SECTOR_SIZE)) {
247+
while ((uintptr_t)hdr < ((uintptr_t)vault_base + WOLFBOOT_SECTOR_SIZE)) {
248248
if ((hdr->token_id == tok_id) && (hdr->object_id == obj_id)
249249
&& (hdr->type == type)) {
250250
tok_obj_stored = (uint32_t *) (vault_base + (2 * WOLFBOOT_SECTOR_SIZE) + (hdr->pos * KEYVAULT_OBJ_SIZE));
@@ -275,7 +275,7 @@ static struct obj_hdr *find_object_header(int32_t type, uint32_t tok_id,
275275
uint32_t obj_id)
276276
{
277277
struct obj_hdr *hdr = NODES_TABLE;
278-
while ((uintptr_t)hdr < ((uintptr_t)NODES_TABLE + WOLFBOOT_SECTOR_SIZE)) {
278+
while ((uintptr_t)hdr < ((uintptr_t)vault_base + WOLFBOOT_SECTOR_SIZE)) {
279279
if ((hdr->token_id == tok_id) && (hdr->object_id == obj_id)
280280
&& (hdr->type == type)) {
281281
return hdr;

‎src/psa_store.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ static uint8_t *find_object_buffer(int32_t type, uint32_t tok_id, uint32_t obj_i
243243
{
244244
struct obj_hdr *hdr = NODES_TABLE;
245245
uint32_t *tok_obj_stored = NULL;
246-
while ((uintptr_t)hdr < ((uintptr_t)NODES_TABLE + WOLFBOOT_SECTOR_SIZE)) {
246+
while ((uintptr_t)hdr < ((uintptr_t)vault_base + WOLFBOOT_SECTOR_SIZE)) {
247247
if ((hdr->token_id == tok_id) && (hdr->object_id == obj_id)
248248
&& (hdr->type == type)) {
249249
tok_obj_stored = (uint32_t *) (vault_base + (2 * WOLFBOOT_SECTOR_SIZE) + (hdr->pos * KEYVAULT_OBJ_SIZE));
@@ -274,7 +274,7 @@ static struct obj_hdr *find_object_header(int32_t type, uint32_t tok_id,
274274
uint32_t obj_id)
275275
{
276276
struct obj_hdr *hdr = NODES_TABLE;
277-
while ((uintptr_t)hdr < ((uintptr_t)NODES_TABLE + WOLFBOOT_SECTOR_SIZE)) {
277+
while ((uintptr_t)hdr < ((uintptr_t)vault_base + WOLFBOOT_SECTOR_SIZE)) {
278278
if ((hdr->token_id == tok_id) && (hdr->object_id == obj_id)
279279
&& (hdr->type == type)) {
280280
return hdr;

‎tools/unit-tests/unit-pkcs11_store.c‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -382,6 +382,36 @@ START_TEST(test_delete_object_ignores_metadata_prefix)
382382
}
383383
END_TEST
384384

385+
START_TEST(test_find_object_search_stops_at_header_sector)
386+
{
387+
const int32_t type = DYNAMIC_TYPE_RSA;
388+
const uint32_t tok_id = 0x11223344U;
389+
const uint32_t obj_id = 0x55667788U;
390+
struct obj_hdr *backup_hdr;
391+
uint32_t *payload_ids;
392+
int ret;
393+
394+
ret = mmap_file("/tmp/wolfboot-unit-keyvault.bin", vault_base,
395+
keyvault_size, NULL);
396+
ck_assert_int_eq(ret, 0);
397+
memset(vault_base, 0xFF, keyvault_size);
398+
399+
backup_hdr = (struct obj_hdr *)(vault_base + WOLFBOOT_SECTOR_SIZE);
400+
backup_hdr->token_id = tok_id;
401+
backup_hdr->object_id = obj_id;
402+
backup_hdr->type = type;
403+
backup_hdr->pos = 0;
404+
backup_hdr->size = 2 * sizeof(uint32_t);
405+
406+
payload_ids = (uint32_t *)(vault_base + 2 * WOLFBOOT_SECTOR_SIZE);
407+
payload_ids[0] = tok_id;
408+
payload_ids[1] = obj_id;
409+
410+
ck_assert_ptr_null(find_object_header(type, tok_id, obj_id));
411+
ck_assert_ptr_null(find_object_buffer(type, tok_id, obj_id));
412+
}
413+
END_TEST
414+
385415
Suite *wolfboot_suite(void)
386416
{
387417
/* Suite initialization */
@@ -391,14 +421,17 @@ Suite *wolfboot_suite(void)
391421
TCase* tcase_cross_sector_write = tcase_create("cross_sector_write");
392422
TCase* tcase_close = tcase_create("close_state");
393423
TCase* tcase_delete_object = tcase_create("delete_object");
424+
TCase* tcase_find_bounds = tcase_create("find_bounds");
394425
tcase_add_test(tcase_store_and_load_objs, test_store_and_load_objs);
395426
tcase_add_test(tcase_cross_sector_write, test_cross_sector_write_preserves_length);
396427
tcase_add_test(tcase_close, test_close_clears_handle_state);
397428
tcase_add_test(tcase_delete_object, test_delete_object_ignores_metadata_prefix);
429+
tcase_add_test(tcase_find_bounds, test_find_object_search_stops_at_header_sector);
398430
suite_add_tcase(s, tcase_store_and_load_objs);
399431
suite_add_tcase(s, tcase_cross_sector_write);
400432
suite_add_tcase(s, tcase_close);
401433
suite_add_tcase(s, tcase_delete_object);
434+
suite_add_tcase(s, tcase_find_bounds);
402435
return s;
403436
}
404437

‎tools/unit-tests/unit-psa_store.c‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,19 +154,52 @@ START_TEST(test_delete_object_ignores_metadata_prefix)
154154
}
155155
END_TEST
156156

157+
START_TEST(test_find_object_search_stops_at_header_sector)
158+
{
159+
enum { type = WOLFPSA_STORE_KEY };
160+
const uint32_t tok_id = 0x11223344U;
161+
const uint32_t obj_id = 0x55667788U;
162+
struct obj_hdr *backup_hdr;
163+
uint32_t *payload_ids;
164+
int ret;
165+
166+
ret = mmap_file("/tmp/wolfboot-unit-psa-keyvault.bin", vault_base,
167+
keyvault_size, NULL);
168+
ck_assert_int_eq(ret, 0);
169+
memset(vault_base, 0xFF, keyvault_size);
170+
171+
backup_hdr = (struct obj_hdr *)(vault_base + WOLFBOOT_SECTOR_SIZE);
172+
backup_hdr->token_id = tok_id;
173+
backup_hdr->object_id = obj_id;
174+
backup_hdr->type = type;
175+
backup_hdr->pos = 0;
176+
backup_hdr->size = 2 * sizeof(uint32_t);
177+
178+
payload_ids = (uint32_t *)(vault_base + 2 * WOLFBOOT_SECTOR_SIZE);
179+
payload_ids[0] = tok_id;
180+
payload_ids[1] = obj_id;
181+
182+
ck_assert_ptr_null(find_object_header(type, tok_id, obj_id));
183+
ck_assert_ptr_null(find_object_buffer(type, tok_id, obj_id));
184+
}
185+
END_TEST
186+
157187
Suite *wolfboot_suite(void)
158188
{
159189
Suite *s = suite_create("wolfBoot-psa-store");
160190
TCase *tcase_write = tcase_create("cross_sector_write");
161191
TCase *tcase_close = tcase_create("close_state");
162192
TCase *tcase_delete = tcase_create("delete_object");
193+
TCase *tcase_find_bounds = tcase_create("find_bounds");
163194

164195
tcase_add_test(tcase_write, test_cross_sector_write_preserves_length);
165196
tcase_add_test(tcase_close, test_close_clears_handle_state);
166197
tcase_add_test(tcase_delete, test_delete_object_ignores_metadata_prefix);
198+
tcase_add_test(tcase_find_bounds, test_find_object_search_stops_at_header_sector);
167199
suite_add_tcase(s, tcase_write);
168200
suite_add_tcase(s, tcase_close);
169201
suite_add_tcase(s, tcase_delete);
202+
suite_add_tcase(s, tcase_find_bounds);
170203
return s;
171204
}
172205

0 commit comments

Comments
 (0)