diff options
| author | Julius Werner <jwerner@chromium.org> | 2019-10-17 18:02:46 -0700 |
|---|---|---|
| committer | Commit Bot <commit-bot@chromium.org> | 2019-10-25 01:29:25 +0000 |
| commit | abc4d18514301ae9ab73f38f2ff16842ba762e80 (patch) | |
| tree | 92f5bf63d24fb8acb8b4ae7ff0a138e0b26bec8b | |
| parent | c07bcc833f49d31c95c45afd3872988deab24bfc (diff) | |
| download | vboot-abc4d18514301ae9ab73f38f2ff16842ba762e80.tar.gz | |
firmware: Fix various UBSAN left shift errors
Shifting a uint8_t left by 24 promotes to an int, not an unsigned int
(and shifts into the sign bit are undefined). Probably doesn't make a
difference in assembly but still doesn't hurt to fix. Courtesy of UBSAN.
BRANCH=None
BUG=chromium:1015908
TEST=None
Change-Id: I92db432eebc52c0432d38dc5fc15a80f3d5527c1
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1867970
Commit-Queue: Stefan Reinauer <reinauer@google.com>
Reviewed-by: Joel Kitching <kitching@chromium.org>
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
| -rw-r--r-- | firmware/2lib/2nvstorage.c | 5 | ||||
| -rw-r--r-- | firmware/2lib/2sha1.c | 2 | ||||
| -rw-r--r-- | firmware/lib/tpm_lite/include/tlcl_internal.h | 2 | ||||
| -rw-r--r-- | firmware/lib/tpm_lite/tlcl.c | 2 |
4 files changed, 6 insertions, 5 deletions
diff --git a/firmware/2lib/2nvstorage.c b/firmware/2lib/2nvstorage.c index 36926ffb..e3846d30 100644 --- a/firmware/2lib/2nvstorage.c +++ b/firmware/2lib/2nvstorage.c @@ -203,7 +203,8 @@ uint32_t vb2_nv_get(struct vb2_context *ctx, enum vb2_nv_param param) return (p[VB2_NV_OFFS_KERNEL_MAX_ROLLFORWARD1] | (p[VB2_NV_OFFS_KERNEL_MAX_ROLLFORWARD2] << 8) | (p[VB2_NV_OFFS_KERNEL_MAX_ROLLFORWARD3] << 16) - | (p[VB2_NV_OFFS_KERNEL_MAX_ROLLFORWARD4] << 24)); + | ((uint32_t)p[VB2_NV_OFFS_KERNEL_MAX_ROLLFORWARD4] + << 24)); case VB2_NV_FW_MAX_ROLLFORWARD: /* Field only present in V2 */ @@ -213,7 +214,7 @@ uint32_t vb2_nv_get(struct vb2_context *ctx, enum vb2_nv_param param) return (p[VB2_NV_OFFS_FW_MAX_ROLLFORWARD1] | (p[VB2_NV_OFFS_FW_MAX_ROLLFORWARD2] << 8) | (p[VB2_NV_OFFS_FW_MAX_ROLLFORWARD3] << 16) - | (p[VB2_NV_OFFS_FW_MAX_ROLLFORWARD4] << 24)); + | ((uint32_t)p[VB2_NV_OFFS_FW_MAX_ROLLFORWARD4] << 24)); case VB2_NV_POST_EC_SYNC_DELAY: return GETBIT(VB2_NV_OFFS_MISC, diff --git a/firmware/2lib/2sha1.c b/firmware/2lib/2sha1.c index a2414143..68ee4fd5 100644 --- a/firmware/2lib/2sha1.c +++ b/firmware/2lib/2sha1.c @@ -195,7 +195,7 @@ static void sha1_transform(struct vb2_sha1_context *ctx) int t; for(t = 0; t < 16; ++t) { - uint32_t tmp = *p++ << 24; + uint32_t tmp = (uint32_t)*p++ << 24; tmp |= *p++ << 16; tmp |= *p++ << 8; tmp |= *p++; diff --git a/firmware/lib/tpm_lite/include/tlcl_internal.h b/firmware/lib/tpm_lite/include/tlcl_internal.h index 98903990..51557d9f 100644 --- a/firmware/lib/tpm_lite/include/tlcl_internal.h +++ b/firmware/lib/tpm_lite/include/tlcl_internal.h @@ -39,7 +39,7 @@ static inline void ToTpmUint32(uint8_t *buffer, uint32_t x) { */ __attribute__((unused)) static inline void FromTpmUint32(const uint8_t *buffer, uint32_t *x) { - *x = ((buffer[0] << 24) | + *x = (((uint32_t)buffer[0] << 24) | (buffer[1] << 16) | (buffer[2] << 8) | buffer[3]); diff --git a/firmware/lib/tpm_lite/tlcl.c b/firmware/lib/tpm_lite/tlcl.c index 1df51609..b6685bf8 100644 --- a/firmware/lib/tpm_lite/tlcl.c +++ b/firmware/lib/tpm_lite/tlcl.c @@ -591,7 +591,7 @@ uint32_t TlclInitNvAuthPolicy(uint32_t pcr_selection_bitmap, uint32_t num_pcrs = 0; int i; for (i = 0; i < sizeof(pcr_selection_bitmap) * 8; ++i) { - if ((1 << i) & pcr_selection_bitmap) { + if ((1U << i) & pcr_selection_bitmap) { num_pcrs++; } } |