Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c96b1fab authored by josephjang's avatar josephjang
Browse files

Keymaster: Fix potential bug in extractUint32()/extractUint64() 

In deserializeVerificationToken(), we use extractUint64() to extract
VerificationToken.challenge. A potential bug was found in
extractUint64() that will cause VerificationToken.challenge()
incorrect.

Bug: 160198696
Change-Id: Ie0d2c0127cc34f1bb90455e4f7869e15e5542173
parent 44c14f77

keymaster/4.0/support/keymaster_utils.cpp

+4 −4
Original line number Original line Diff line number Diff line
@@ -121,8 +121,8 @@ void appendUint64(std::vector<uint8_t>& vec, uint64_t value) { 
uint64_t extractUint64(const std::vector<uint8_t>& data, size_t offset) {

uint64_t extractUint64(const std::vector<uint8_t>& data, size_t offset) {

    uint64_t value = 0;

    uint64_t value = 0;

    for (size_t n = 0; n < sizeof(uint64_t); n++) {

    for (size_t n = 0; n < sizeof(uint64_t); n++) {

        uint8_t byte = data[offset + n];

        uint64_t tmp = data[offset + n];

        value |= byte << (n * 8);

        value |= (tmp << (n * 8));

    }

    }

    return value;

    return value;

}

}
@@ -137,8 +137,8 @@ void appendUint32(std::vector<uint8_t>& vec, uint32_t value) { 
uint32_t extractUint32(const std::vector<uint8_t>& data, size_t offset) {

uint32_t extractUint32(const std::vector<uint8_t>& data, size_t offset) {

    uint32_t value = 0;

    uint32_t value = 0;

    for (size_t n = 0; n < sizeof(uint32_t); n++) {

    for (size_t n = 0; n < sizeof(uint32_t); n++) {

        uint8_t byte = data[offset + n];

        uint32_t tmp = data[offset + n];

        value |= byte << (n * 8);

        value |= (tmp << (n * 8));

    }

    }

    return value;

    return value;

}

}