From e79d060f4d560584b1e4936049fc0c5d73a031e8 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Wed, 22 Jul 2026 10:33:35 -0700 Subject: [PATCH] Guard tainted PCR select copy in fwTPM PCR_PROPERTIES test (Coverity CID 911493) --- tests/fwtpm_unit_tests.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/fwtpm_unit_tests.c b/tests/fwtpm_unit_tests.c index 873b014d..765a7c66 100644 --- a/tests/fwtpm_unit_tests.c +++ b/tests/fwtpm_unit_tests.c @@ -8558,6 +8558,7 @@ static void test_fwtpm_pcr_properties_capability(void) tag = GetU32BE(gRsp + p); p += 4; wireSz = gRsp[p]; p += 1; selSz = (wireSz > 8) ? 8 : wireSz; + AssertTrue(selSz > 0); /* select bytes present; keeps p inside gRsp */ AssertTrue(p + selSz <= rspSize); if (tag == TPM_PT_PCR_RESET_L0) { memcpy(resetL0, gRsp + p, selSz); gotResetL0 = 1; @@ -8571,6 +8572,7 @@ static void test_fwtpm_pcr_properties_capability(void) else if (tag == TPM_PT_PCR_DRTM_RESET) { memcpy(drtm, gRsp + p, selSz); gotDrtm = 1; } + AssertTrue(p + wireSz <= rspSize); /* full record present on the wire */ p += wireSz; /* advance past the select bytes */ }