google / OpenSK / 37750512768

97%

2.1: 97%

push

github

Reject large blob parameters that do not fit in usize (#789)

The get, offset and length parameters of the large blobs command were
cast from u64 to usize, which silently truncates values on platforms
with a 32-bit usize (the supported embedded targets). A crafted
request with a value of 2^32 or more could therefore bypass the size
checks that follow in the command processing.

Introduce extract_usize, which rejects values that do not fit instead
of truncating them, and use it for the large blobs parameters. The
same pattern already existed for the bio enrollment timeout, which is
simplified to use the new helper as well. Behavior on 64-bit platforms
is unchanged.

Co-authored-by: VAMSI KRISHNA <189184574+17krishna8@users.noreply.github.com>

38 of 38 new or added lines in 2 files covered. (100.0%)

13697 of 14083 relevant lines covered (97.26%)

4294.92 hits per line