google / OpenSK / 41820746851

98%

2.1: 97%

push

github

Fails closed on large blob arrays that exceed the shard capacity (#833)

* Fails closed on large blob arrays that exceed the shard capacity

commit_large_blob_array only enforced the shard capacity with
debug_assert!, which is compiled out in release builds. Arrays larger
than the four large blob shards (4092 bytes) were silently truncated
while reporting success to the platform.

This adds a runtime check to the commit, returning
CTAP2_ERR_LARGE_BLOB_STORAGE_FULL, and enforces the corresponding upper
bound in Customization::is_valid, which previously only checked the
documented lower bound of 1024 bytes.

* Gates the large blob capacity import behind the std feature

is_valid() is only compiled with std, so the import is otherwise unused
and breaks the firmware build with -D warnings.

* Removes the max_large_blob_array_size customization

The shard capacity is the only sensible upper bound for a large blob
array, so advertising a configurable limit that can differ from it is
confusing. The CTAP layer now advertises and enforces
MAX_LARGE_BLOB_ARRAY_SIZE directly, is_valid() no longer needs the
corresponding bounds checks, and the tests that only exercised the
customization are gone.

---------

Co-authored-by: 17krishna8 <17krishna8@users.noreply.github.com>

21 of 21 new or added lines in 3 files covered. (100.0%)

14686 of 15068 relevant lines covered (97.46%)

3976.77 hits per line