tpm_lite: Check TPM response sizes without overflow

TlclGetSpaceInfo() checks cap_size against
response_size - sizeof(cap_size) - kTpmResponseHeaderLength, but does
not check that response_size is at least that large. For a response
shorter than 14 bytes, the subtraction wraps, any cap_size passes the
check, and the end pointer is computed far past the response buffer.
It also skips the tag and index without checking that cap_size covers
them. For a smaller cap_size, the cursor moves past the end pointer,
and DecodePCRInfo() computes a wrapped available size.

TlclGetVersion() checks the size from the TPM with
kTpmResponseHeaderLength + sizeof(size) + size > LIMIT. The sum is a
size_t, which wraps on 32-bit builds when size is close to UINT32_MAX.
The check then passes, and the vendor specific data is copied from
past the end of the response buffer.

In TlclGetSpaceInfo(), check the minimum response size, and require
cap_size to cover the tag and index. In TlclGetVersion(), rewrite the
check so that it cannot overflow. The new TlclGetVersion() test case
only fails without this change on 32-bit builds.

BRANCH=none
BUG=none
TEST=make runmisctests USE_FLASHROM=0
TAG=agy
CONV=c232d14d-77d1-417e-aa14-965a33a46cf9

Signed-off-by: Yu-Ping Wu <yupingso@google.com>
Change-Id: I53d715c7421b29973452a88388fe6c846a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/8773748
Reviewed-by: Grzegorz Bernacki <bernacki@google.com>
Commit-Queue: Yu-Ping Wu <yupingso@chromium.org>
Tested-by: Yu-Ping Wu <yupingso@chromium.org>