From c6d74eebfb1669603840fe513482bf4072924fa9 Mon Sep 17 00:00:00 2001 From: Steffen Eiden Date: Tue, 28 Jul 2026 16:29:55 +0200 Subject: [PATCH] pvimg: Fix hash comparison in SeHdrAadV2::contains_hash Ensure both sides of the hash comparison use the same slice length by explicitly slicing both the keyslot hash and the input hash to UV_KEY_HASH_SIZE. Previously, only the keyslot hash was sliced while comparing against the full input hash reference, which could lead to incorrect comparisons if the input hash length differs. This makes the comparison more explicit and ensures we're always comparing equal-length hashes. This is useful if one hash is a subset of another, e.g. a sha512 hash truncated to 32 bytes. Fixes: 89577c2f8c77 ("pvimg: Use hybrid keys") Reviewed-by: Marc Hartmayer Signed-off-by: Steffen Eiden --- rust/pvimg/src/pv_utils/se_hdr/hdr_v2.rs | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/rust/pvimg/src/pv_utils/se_hdr/hdr_v2.rs b/rust/pvimg/src/pv_utils/se_hdr/hdr_v2.rs index 4d481de1..eaeed7fa 100644 --- a/rust/pvimg/src/pv_utils/se_hdr/hdr_v2.rs +++ b/rust/pvimg/src/pv_utils/se_hdr/hdr_v2.rs @@ -118,11 +118,26 @@ impl KeyExchangeTrait for SeHdrAadV2 { Self::KEY_TYPE } + /** contains_hash - test if the given hash is in this SE-header + * + * * `hash`: hash to compare, either 32 or 64 byte long + * + * Returns: + * - false if the given hash is not 64 or 32 bytes long + * - the comparison result otherwise + */ fn contains_hash>(&self, hash: H) -> bool { let hash = hash.as_ref(); + let size = hash.len(); + + match size { + UvKeyHashV1::UV_KEY_HASH_SIZE | SHA_512_HASH_LEN => (), + _ => return false, + }; + self.keyslots .iter() - .any(|ks| &ks.phkh[..UvKeyHashV1::UV_KEY_HASH_SIZE] == hash) + .any(|ks| ks.phkh[..size] == hash[..size]) } fn contains(&self, key: K) -> Result