Fix Coverity CIDs 909308/909295/483395/483392 (fwTPM hash returns, setsockopt, secret_seal hex/policy)

Author: aidangarske

examples/boot/secret_seal.c

@@ -116,7 +116,7 @@ int TPM2_Boot_SecretSeal_Example(void* userCtx, int argc, char *argv[])
     word32 secretSz = 0;
     const char* publicKeyFile = NULL;
     const char* outFile = "sealblob.bin";
-    const char* policyFile = "policyauth.bin";
+    const char* policyFile = NULL;
     byte policyDigest[WC_MAX_DIGEST_SIZE];
     word32 policyDigestSz = 0;
 
@@ -151,9 +151,16 @@ int TPM2_Boot_SecretSeal_Example(void* userCtx, int argc, char *argv[])
         else if (XSTRNCMP(argv[argc-1], "-secrethex=", XSTRLEN("-secrethex=")) == 0) {
             const char* secretStr = argv[argc-1] + XSTRLEN("-secrethex=");
             word32 secretStrSz = (word32)XSTRLEN(secretStr);
+            int secretHexSz;
             if (secretStrSz > (word32)(sizeof(secret)*2-1))
                 secretStrSz = (word32)(sizeof(secret)*2-1);
-            secretSz = hexToByte(secretStr, secret, secretStrSz);
+            secretHexSz = hexToByte(secretStr, secret, secretStrSz);
+            if (secretHexSz < 0) {
+                printf("Invalid secret hex string\n");
+                usage();
+                return -1;
+            }
+            secretSz = (word32)secretHexSz;
         }
         else if (XSTRNCMP(argv[argc-1], "-policy=",
                 XSTRLEN("-policy=")) == 0) {

src/fwtpm/fwtpm_command.c

@@ -9948,14 +9948,24 @@ static TPM_RC FwCmd_PolicyNV(FWTPM_CTX* ctx, TPM2_Packet* cmd,
         }
     }
     if (rc == 0 && operandBSz > 0) {
-        wc_HashUpdate(hashCtx, wcHash, operandB, operandBSz);
+        if (wc_HashUpdate(hashCtx, wcHash, operandB, operandBSz) != 0)
+            rc = TPM_RC_FAILURE;
     }
     if (rc == 0) {
         FwStoreU16BE(tmpBuf, offset);
-        wc_HashUpdate(hashCtx, wcHash, tmpBuf, 2);
+        if (wc_HashUpdate(hashCtx, wcHash, tmpBuf, 2) != 0)
+            rc = TPM_RC_FAILURE;
+    }
+    if (rc == 0) {
         FwStoreU16BE(tmpBuf, operation);
-        wc_HashUpdate(hashCtx, wcHash, tmpBuf, 2);
-        wc_HashFinal(hashCtx, wcHash, argsHash);
+        if (wc_HashUpdate(hashCtx, wcHash, tmpBuf, 2) != 0)
+            rc = TPM_RC_FAILURE;
+    }
+    if (rc == 0) {
+        if (wc_HashFinal(hashCtx, wcHash, argsHash) != 0)
+            rc = TPM_RC_FAILURE;
+    }
+    if (rc == 0) {
         wc_HashFree(hashCtx, wcHash);
         hashCtxInit = 0;
     }
@@ -9972,15 +9982,28 @@ static TPM_RC FwCmd_PolicyNV(FWTPM_CTX* ctx, TPM2_Packet* cmd,
         }
     }
     if (rc == 0) {
-        wc_HashUpdate(hashCtx, wcHash,
-            sess->policyDigest.buffer, sess->policyDigest.size);
+        if (wc_HashUpdate(hashCtx, wcHash,
+                sess->policyDigest.buffer, sess->policyDigest.size) != 0)
+            rc = TPM_RC_FAILURE;
+    }
+    if (rc == 0) {
         FwStoreU32BE(ccBuf, cc);
-        wc_HashUpdate(hashCtx, wcHash, ccBuf, 4);
-        wc_HashUpdate(hashCtx, wcHash, argsHash, dSz);
-        if (nvNameSz > 0) {
-            wc_HashUpdate(hashCtx, wcHash, nvName, nvNameSz);
-        }
-        wc_HashFinal(hashCtx, wcHash, sess->policyDigest.buffer);
+        if (wc_HashUpdate(hashCtx, wcHash, ccBuf, 4) != 0)
+            rc = TPM_RC_FAILURE;
+    }
+    if (rc == 0) {
+        if (wc_HashUpdate(hashCtx, wcHash, argsHash, dSz) != 0)
+            rc = TPM_RC_FAILURE;
+    }
+    if (rc == 0 && nvNameSz > 0) {
+        if (wc_HashUpdate(hashCtx, wcHash, nvName, nvNameSz) != 0)
+            rc = TPM_RC_FAILURE;
+    }
+    if (rc == 0) {
+        if (wc_HashFinal(hashCtx, wcHash, sess->policyDigest.buffer) != 0)
+            rc = TPM_RC_FAILURE;
+    }
+    if (rc == 0) {
         sess->policyDigest.size = (UINT16)dSz;
         wc_HashFree(hashCtx, wcHash);
         hashCtxInit = 0;

src/fwtpm/fwtpm_io.c

@@ -169,8 +169,12 @@ static SOCKET_T CreateListenSocket(int port)
         return FWTPM_INVALID_FD;
     }
 
-    setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
-        (const char*)&optval, sizeof(optval));
+    if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
+            (const char*)&optval, sizeof(optval)) != 0) {
+    #ifdef DEBUG_WOLFTPM
+        printf("fwTPM: setsockopt(SO_REUSEADDR) failed\n");
+    #endif
+    }
 
     XMEMSET(&addr, 0, sizeof(addr));
     addr.sin_family = AF_INET;