fwTPM/wolfTPM testing and hardening

examples/firmware/ifx_fw_extract.c

@@ -180,7 +180,8 @@ static int extractFW(
     }
 
     READ_BE32(size32, fw, fw_size, offset);
-    if (offset + size32 > fw_size) {
+    /* offset <= fw_size here; subtract to avoid size_t wrap on 32-bit */
+    if (size32 > fw_size - offset) {
         LOG("FW file too short");
         return -1;
     }

examples/nvram/read.c

@@ -211,6 +211,14 @@ int TPM2_NVRAM_Read_Example(void* userCtx, int argc, char *argv[])
             printf("Successfully read public key part from NV\n\n");
             offset += readSize;
 
+            /* pub.size comes from NV and must fit the destination buffer */
+            if (readSize != sizeof(keyBlob.pub.size) ||
+                    sizeof(UINT16) + keyBlob.pub.size > sizeof(pubAreaBuffer)) {
+                printf("Invalid public key size marker from NV\n");
+                rc = BUFFER_E;
+                goto exit;
+            }
+
             readSize = sizeof(UINT16) + keyBlob.pub.size; /* account for TPM2B size marker */
             printf("Trying to read %d bytes of public key part from NV\n", keyBlob.pub.size);
             rc = wolfTPM2_NVReadAuth(&dev, &nv, nvIndex,
@@ -244,6 +252,14 @@ int TPM2_NVRAM_Read_Example(void* userCtx, int argc, char *argv[])
             printf("Successfully read size marker from NV\n\n");
             offset += readSize;
 
+            /* priv.size comes from NV and must fit the destination buffer */
+            if (readSize != sizeof(keyBlob.priv.size) ||
+                    keyBlob.priv.size > sizeof(keyBlob.priv.buffer)) {
+                printf("Invalid private key size marker from NV\n");
+                rc = BUFFER_E;
+                goto exit;
+            }
+
             readSize = keyBlob.priv.size;
             printf("Trying to read %d bytes of private key part from NV\n", readSize);
             rc = wolfTPM2_NVReadAuth(&dev, &nv, nvIndex,

scripts/tpm2_tools_test.sh

@@ -522,10 +522,12 @@ flush_transient
 run_test "createprimary for attestation" \
     tpm2_createprimary -C o -g sha256 -G rsa -c "$TEST_TMPDIR/att_primary.ctx"
 
-# Create child AIK for signing
+# Create child AIK for signing. Quote requires a restricted signing key
+# (TPM 2.0 Part 3 Sec.18.4), so set the canonical attestation-key attributes.
 run_test "create AIK (RSA signing key)" \
     tpm2_create -C "$TEST_TMPDIR/att_primary.ctx" \
         -g sha256 -G rsa:rsassa:null \
+        -a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|sign" \
         -u "$TEST_TMPDIR/aik.pub" -r "$TEST_TMPDIR/aik.priv"
 
 run_test "load AIK" \