From 4be18833036fdac7a24b49e6e306b62e97375fd3 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 3 Jul 2026 11:03:37 +0200 Subject: [PATCH] pts-database: Reject reference file measurements with incorrect size If the received measurement hash exceeded 64 bytes, the `hex_meas_buf` buffer overflowed in the `chunk_to_hex()` call. Since this is only called when collecting measurements from a trusted reference system, it shouldn't be an issue in practice. Fixes: 076aac70693d ("imv-attestation: Fixed file hash measurements") --- src/libimcv/pts/pts_database.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/libimcv/pts/pts_database.c b/src/libimcv/pts/pts_database.c index 5b7f21b5f..27dece3f3 100644 --- a/src/libimcv/pts/pts_database.c +++ b/src/libimcv/pts/pts_database.c @@ -186,6 +186,14 @@ METHOD(pts_database_t, add_file_measurement, bool, int hash_id, fid; bool success = TRUE; + if (measurement.len > HASH_SIZE_SHA512 || + measurement.len != pts_meas_algo_hash_size(algo)) + { + DBG1(DBG_PTS, "invalid %N file measurement length %zu for '%s'", + pts_meas_algorithm_names, algo, measurement.len, filename); + return FALSE; + } + if (is_dir) { /* does filename entry already exist? */