Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
** CID 506049: Insecure data handling (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 568 in parse_pcrs_find()
_____________________________________________________________________________________________
*** CID 506049: Insecure data handling (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 568 in parse_pcrs_find()
562 if (ret != TPM_SUCCESS) {
563 return ret;
564 }
565
566 iter_read_u32_be(&iter, &count);
567
>>> CID 506049: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "count" as a loop boundary.
568 for (uint32_t i = 0U; i < count; i++) {
569 iter_read_u16_be(&iter, &hash_id);
570 iter_read_u8(&iter, &sizeof_select);
571 if (iter.error_state != TPM_SUCCESS) {
572 return iter.error_state;
573 }
** CID 506048: Memory - corruptions (OVERRUN)
_____________________________________________________________________________________________
*** CID 506048: Memory - corruptions (OVERRUN)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 1071 in tpm_has_alg()
1065 }
1066
1067 item[0].alg_id = alg_id;
1068 item[0].enabled = false;
1069 item[1].alg_id = TPM_ALG_NULL;
1070 item[1].enabled = false;
>>> CID 506048: Memory - corruptions (OVERRUN)
>>> Overrunning array "item" of 2 4-byte elements by passing it to a function which accesses it at element index 63 (byte offset 255).
1071 ret = tpm_getcap_query_algs(chip, item);
1072 if (ret != TPM_SUCCESS) {
1073 return ret;
1074 }
1075
1076 *out_supported = item[0].enabled;
** CID 506047: Insecure data handling (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 444 in parse_algs_find()
_____________________________________________________________________________________________
*** CID 506047: Insecure data handling (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 444 in parse_algs_find()
438 if (ret != TPM_SUCCESS) {
439 return ret;
440 }
441
442 iter_read_u32_be(&iter, &count);
443
>>> CID 506047: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "count" as a loop boundary.
444 for (uint32_t i = 0U; i < count; i++) {
445 iter_read_u16_be(&iter, &alg);
446 iter_read_u32_be(&iter, &props);
447 if (iter.error_state != TPM_SUCCESS) {
448 return iter.error_state;
449 }
** CID 506046: Insecure data handling (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 386 in parse_algs()
_____________________________________________________________________________________________
*** CID 506046: Insecure data handling (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 386 in parse_algs()
380 if (ret != TPM_SUCCESS) {
381 return ret;
382 }
383
384 iter_read_u32_be(&iter, &count);
385
>>> CID 506046: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "count" as a loop boundary.
386 for (uint32_t i = 0U; i < count; i++) {
387 iter_read_u16_be(&iter, &alg);
388 iter_read_u32_be(&iter, &properties);
389 if (iter.error_state != TPM_SUCCESS) {
390 return iter.error_state;
391 }
** CID 506045: Insecure data handling (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 498 in parse_pcrs()
_____________________________________________________________________________________________
*** CID 506045: Insecure data handling (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 498 in parse_pcrs()
492 if (ret != TPM_SUCCESS) {
493 return ret;
494 }
495
496 iter_read_u32_be(&iter, &count);
497
>>> CID 506045: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "count" as a loop boundary.
498 for (uint32_t i = 0U; i < count; i++) {
499 iter_read_u16_be(&iter, &hash);
500 iter_read_u8(&iter, &sizeof_select);
501 if (iter.error_state != TPM_SUCCESS) {
502 return iter.error_state;
503 }
Best regards,
The Coverity Scan Admin Team
