google / OpenSK / 39464164098

97%

2.1: 97%

push

github

Truncate user names when updating user information (#804)

MakeCredential crops the user name, display name and icon to 64 bytes
before storing a discoverable credential, with a comment explaining
that this is done because the input is user provided. The
updateUserInformation subcommand writes the same fields back without
that crop.

A platform holding a credMgmt token can therefore update a resident
credential with a much longer user name. The serialization could then
exceed the maximum value size of the persistent store, which fails the
update.

Truncate the fields to 64 bytes like MakeCredential does, reusing the
same helper.

Co-authored-by: 17krishna8 <17krishna8@users.noreply.github.com>

71 of 71 new or added lines in 1 file covered. (100.0%)

14293 of 14681 relevant lines covered (97.36%)

4079.98 hits per line