)]}'
{
  "commit": "04f0265e68818416dd2bdf0ee4b2fbe49aa2de16",
  "tree": "51d7a943b50142f7b1fc46538242a01371087c84",
  "parents": [
    "7b38c0349b3e0024498d61c0c846cdc03b1217ef"
  ],
  "author": {
    "name": "Yu-Ping Wu",
    "email": "yupingso@google.com",
    "time": "Fri Nov 06 14:52:43 2026 +0800"
  },
  "committer": {
    "name": "CrOS LUCI",
    "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Tue Nov 10 05:24:18 2026 -0800"
  },
  "message": "tpm_lite: Check TPM response sizes without overflow\n\nTlclGetSpaceInfo() checks cap_size against\nresponse_size - sizeof(cap_size) - kTpmResponseHeaderLength, but does\nnot check that response_size is at least that large. For a response\nshorter than 14 bytes, the subtraction wraps, any cap_size passes the\ncheck, and the end pointer is computed far past the response buffer.\nIt also skips the tag and index without checking that cap_size covers\nthem. For a smaller cap_size, the cursor moves past the end pointer,\nand DecodePCRInfo() computes a wrapped available size.\n\nTlclGetVersion() checks the size from the TPM with\nkTpmResponseHeaderLength + sizeof(size) + size \u003e LIMIT. The sum is a\nsize_t, which wraps on 32-bit builds when size is close to UINT32_MAX.\nThe check then passes, and the vendor specific data is copied from\npast the end of the response buffer.\n\nIn TlclGetSpaceInfo(), check the minimum response size, and require\ncap_size to cover the tag and index. In TlclGetVersion(), rewrite the\ncheck so that it cannot overflow. The new TlclGetVersion() test case\nonly fails without this change on 32-bit builds.\n\nBRANCH\u003dnone\nBUG\u003dnone\nTEST\u003dmake runmisctests USE_FLASHROM\u003d0\nTAG\u003dagy\nCONV\u003dc232d14d-77d1-417e-aa14-965a33a46cf9\n\nSigned-off-by: Yu-Ping Wu \u003cyupingso@google.com\u003e\nChange-Id: I53d715c7421b29973452a88388fe6c846a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/8773748\nReviewed-by: Grzegorz Bernacki \u003cbernacki@google.com\u003e\nCommit-Queue: Yu-Ping Wu \u003cyupingso@chromium.org\u003e\nTested-by: Yu-Ping Wu \u003cyupingso@chromium.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7036024a04400e35e0edb4db40871c2b04c54123",
      "old_mode": 33188,
      "old_path": "firmware/lib/tpm_lite/tlcl.c",
      "new_id": "f8d69e0aab88b33c5a624ea8dcf39a5da3adf415",
      "new_mode": 33188,
      "new_path": "firmware/lib/tpm_lite/tlcl.c"
    },
    {
      "type": "modify",
      "old_id": "ac0f79c9d97fe25e635f9c5e1d9a6bc4e3415baf",
      "old_mode": 33188,
      "old_path": "tests/tlcl_tests.c",
      "new_id": "74817f41e17d1b9aa61151b3dc44d25b753c7f20",
      "new_mode": 33188,
      "new_path": "tests/tlcl_tests.c"
    }
  ]
}