From a93146d9767eef5a8c81591ba38a14262278485f Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Fri, 3 Jul 2026 14:36:24 +0200 Subject: [PATCH] pv: BinReqValues: Fix length validation in get() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Return an error when the provided request data is smaller than the expected request length. The previous condition used the wrong comparison, which could lead to an out-of-bounds slice and panic. Add a regression test. Fixes: 34bef977e882 ("rust/pv: User-data signing and verifying") Assisted-by: IBM Bob:1.0.5 Signed-off-by: Marc Hartmayer Reviewed-by: Steffen Eiden Signed-off-by: Jan Höppner --- rust/pv/src/req/request.rs | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/rust/pv/src/req/request.rs b/rust/pv/src/req/request.rs index 1084b7e2..2bed8e53 100644 --- a/rust/pv/src/req/request.rs +++ b/rust/pv/src/req/request.rs @@ -79,7 +79,7 @@ impl<'a> BinReqValues<'a> { let rql = hdr.rql.get() as usize; let sea = hdr.sea.get() as usize; - if rql < req.len() || sea + Self::TAG_LEN > rql { + if req.len() < rql || sea + Self::TAG_LEN > rql { return Err(Error::BinRequestSmall); } let aad_size = rql - sea - Self::TAG_LEN; @@ -262,4 +262,18 @@ mod tests { ]; assert_eq!(hdr_bin, &hdr_bin_exp); } + + #[test] + fn bin_req_values_buffer_too_small() { + // Create a valid header with request length set to 200 bytes + let hdr = RequestHdr::new(0x200, 200, [0x11; 12], 1, 32, Some(TEST_MAGIC)); + let hdr_bin = hdr.as_bytes(); + + // Create a buffer that's smaller than the declared request length (48 + // bytes) + let small_buffer = Vec::from(hdr_bin); + + let result = BinReqValues::get(&small_buffer); + assert!(matches!(result, Err(Error::BinRequestSmall))); + } }