Bound TPM2 response decrypt-parameter size, zeroize primary-key auth, and expand marshalling/import test coverage

src/fwtpm/fwtpm_command.c

@@ -16735,17 +16735,13 @@ int FWTPM_ProcessCommand(FWTPM_CTX* ctx,
 
             /* PolicyPassword with no sessionKey (unsalted/unbound):
              * HMAC field contains plaintext authValue per spec Section 19.6.13.
-             * Always run TPM2_ConstantCompare so timing doesn't leak auth
-             * length match. */
+             * Use fixed-length FwCtAuthCompare so the compare trip count can't
+             * leak the auth value length (matches the TPM_RS_PW path). */
             if (hSess->sessionType == TPM_SE_POLICY &&
                 hSess->isPasswordPolicy &&
                 hSess->sessionKey.size == 0) {
-                sizeMismatch = ((int)cmdAuths[hj].cmdHmacSize != authValSz);
-                cmpSz = (cmdAuths[hj].cmdHmacSize < (UINT16)authValSz) ?
-                    cmdAuths[hj].cmdHmacSize : (word32)authValSz;
-                hmacDiff = TPM2_ConstantCompare(cmdAuths[hj].cmdHmac,
-                    authVal, cmpSz);
-                if (sizeMismatch | hmacDiff) {
+                if (FwCtAuthCompare(cmdAuths[hj].cmdHmac,
+                        (int)cmdAuths[hj].cmdHmacSize, authVal, authValSz)) {
                 #ifdef DEBUG_WOLFTPM
                     printf("fwTPM: PolicyPassword auth failed for handle "
                         "0x%x (CC=0x%x)\n", entityH, cmdCode);

src/tpm2.c

@@ -314,20 +314,35 @@ int TPM2_ResponseProcess(TPM2_CTX* ctx, TPM2_Packet* packet,
     param = &packet->buf[packet->pos]; /* Mark parameter data */
     authPos = packet->pos + paramSz;
 
-    /* Mark "first" decryption parameter */
+    /* Mark "first" decryption parameter. Reject a parameter area too small to
+     * hold the size prefix before parsing it, so a truncated response returns
+     * TPM_RC_SIZE without reading past the declared parameter area. */
     if (info->flags & CMD_FLAG_DEC2) {
         UINT16 tempSz;
+        if (paramSz < sizeof(UINT16))
+            return TPM_RC_SIZE;
         TPM2_Packet_ParseU16(packet, &tempSz);
         decParam = param + sizeof(UINT16);
         decParamSz = tempSz;
     }
     else if (info->flags & CMD_FLAG_DEC4) {
         UINT32 tempSz;
+        if (paramSz < sizeof(UINT32))
+            return TPM_RC_SIZE;
         TPM2_Packet_ParseU32(packet, &tempSz);
         decParam = param + sizeof(UINT32);
         decParamSz = tempSz;
     }
 
+    /* Bound the decrypt region to the parameter area so a malicious or faulty
+     * TPM cannot drive an out-of-bounds parameter decryption write */
+    if (decParam != NULL) {
+        UINT32 decOffset = (UINT32)(decParam - param);
+        if (decParamSz > paramSz - decOffset) {
+            return TPM_RC_SIZE;
+        }
+    }
+
 #ifdef WOLFTPM_DEBUG_VERBOSE
     printf("ResponseProcess: Handles (Out %d), RespSz %d, ParamSz %d, DecSz %d, AuthSz %d\n",
         info->outHandleCnt, (int)respSz, (int)paramSz, (int)decParamSz, (int)(respSz - authPos));

src/tpm2_wrap.c

@@ -2833,6 +2833,8 @@ int wolfTPM2_CreatePrimaryKey(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
         XMEMCPY(&key->handle, &pKey.handle, sizeof(WOLFTPM2_HANDLE));
         XMEMCPY(&key->pub, &pKey.pub, sizeof(TPM2B_PUBLIC));
     }
+    /* scrub the duplicated primary-key auth from the local copy */
+    TPM2_ForceZero(&pKey, sizeof(pKey));
     return rc;
 }