diff mbox series

[ima-evm-utils,v2,11/12] Missing template data size lower bounds checking

Message ID 20220906195021.854090-12-zohar@linux.ibm.com (mailing list archive)
State New, archived
Headers show
Series address deprecated warnings | expand

Commit Message

Mimi Zohar Sept. 6, 2022, 7:50 p.m. UTC
Each record in the IMA measurement list must contain some template data.
Ensure the template data is not zero length.

Reviewed-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 src/evmctl.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Stefan Berger Sept. 13, 2022, 4:34 p.m. UTC | #1
On 9/6/22 15:50, Mimi Zohar wrote:
> Each record in the IMA measurement list must contain some template data.
> Ensure the template data is not zero length.
> 
> Reviewed-by: Petr Vorel <pvorel@suse.cz>
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>

> ---
>   src/evmctl.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/src/evmctl.c b/src/evmctl.c
> index aac669438a1c..e603449b7d9e 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -2188,6 +2188,10 @@ static int ima_measurement(const char *file)
>   				log_err("Unable to read template length\n");
>   				goto out;
>   			}
> +			if (entry.template_len == 0) {
> +				log_err("Invalid template data len\n");
> +				goto out;
> +			}
>   		} else {
>   			entry.template_len = SHA_DIGEST_LENGTH +
>   					     TCG_EVENT_NAME_LEN_MAX + 1;
diff mbox series

Patch

diff --git a/src/evmctl.c b/src/evmctl.c
index aac669438a1c..e603449b7d9e 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -2188,6 +2188,10 @@  static int ima_measurement(const char *file)
 				log_err("Unable to read template length\n");
 				goto out;
 			}
+			if (entry.template_len == 0) {
+				log_err("Invalid template data len\n");
+				goto out;
+			}
 		} else {
 			entry.template_len = SHA_DIGEST_LENGTH +
 					     TCG_EVENT_NAME_LEN_MAX + 1;