google / OpenSK / 37961562904

97%

2.1: 97%

push

github

Validate large blob parameters before mutating write state (#797)

In LargeBlobState::process_command, an offset == 0 write mutated
self.expected_length before checking max_large_blob_array_size() and
TRUNCATED_HASH_LEN, and updated self.expected_next_offset = 0 before
verifying pin_uv_auth_param and checking that the chunk fits within
expected_length.

If an offset == 0 request failed validation or authentication while a
multi-fragment write was in progress, self.expected_length and/or
self.expected_next_offset were overwritten while self.buffer retained
the previous write's bytes. In particular, an offset == 0 request with
length > max_large_blob_array_size() after an initial valid chunk left
self.expected_length set to the oversized length and allowed subsequent
chunks at offset > 0 to bypass max_large_blob_array_size().

Validate length, authentication, and chunk bounds before mutating
LargeBlobState on offset == 0, and clear the state when the final chunk
is processed regardless of whether the hash check succeeds.

54 of 55 new or added lines in 1 file covered. (98.18%)

13809 of 14204 relevant lines covered (97.22%)

4258.56 hits per line