Skip to content

Commit 5c2259d

Browse files
Li-AaronLi-Aaron
committed
Fix chunk_seq_no wrap in chunk get.
Fix #2875 Signed-off-by: Aaron Li <aaron.li@intel.com>
1 parent e0d668a commit 5c2259d

2 files changed

Lines changed: 99 additions & 2 deletions

File tree

‎library/spdm_requester_lib/libspdm_req_handle_error_response.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* Copyright Notice:
3-
* Copyright 2021-2024 DMTF. All rights reserved.
3+
* Copyright 2021-2025 DMTF. All rights reserved.
44
* License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md
55
**/
66

@@ -280,6 +280,12 @@ libspdm_return_t libspdm_handle_error_large_response(
280280
spdm_request->chunk_seq_no = chunk_seq_no;
281281
spdm_request_size = sizeof(spdm_chunk_get_request_t);
282282

283+
if (chunk_seq_no == 0 && large_response_size_so_far != 0) {
284+
/* chunk_seq_no wrapped */
285+
status = LIBSPDM_STATUS_INVALID_MSG_FIELD;
286+
break;
287+
}
288+
283289
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,
284290
"CHUNK_GET Handle %d SeqNo %d\n", chunk_handle, chunk_seq_no));
285291

‎unit_test/test_spdm_requester/chunk_get.c‎

Lines changed: 92 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* Copyright Notice:
3-
* Copyright 2021-2024 DMTF. All rights reserved.
3+
* Copyright 2021-2025 DMTF. All rights reserved.
44
* License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md
55
**/
66

@@ -15,6 +15,10 @@ static size_t m_libspdm_local_certificate_chain_size_test_case_1;
1515

1616
static uint8_t m_libspdm_local_large_response_buffer[LIBSPDM_MAX_SPDM_MSG_SIZE];
1717

18+
#define BUFFER_SIZE_FOR_CHUNK_SEQ_NO_WRAP_TEST 0x200000
19+
static uint8_t m_libspdm_local_response_buffer_for_chunk_seq_no_wrap_test[
20+
BUFFER_SIZE_FOR_CHUNK_SEQ_NO_WRAP_TEST];
21+
1822
static size_t m_libspdm_local_buffer_size;
1923
static uint8_t m_libspdm_local_buffer[LIBSPDM_MAX_MESSAGE_M1M2_BUFFER_SIZE];
2024

@@ -259,6 +263,29 @@ void libspdm_requester_chunk_get_test_case4_build_digest_response(
259263
spdm_response->header.param2 |= (0xFF << 0);
260264
}
261265

266+
void libspdm_requester_chunk_get_test_case5_build_vendor_response(
267+
void* context, void* response, size_t* response_size)
268+
{
269+
spdm_vendor_defined_response_msg_t *spdm_response;
270+
271+
/* For exceed max chunk seq no */
272+
*response_size =
273+
(CHUNK_GET_REQUESTER_UNIT_TEST_DATA_TRANSFER_SIZE -
274+
sizeof(spdm_chunk_response_response_t)) * 65536 - sizeof(uint32_t) + 0x10;
275+
276+
libspdm_set_mem(response, *response_size, 0xff);
277+
278+
spdm_response = response;
279+
280+
spdm_response->header.spdm_version = SPDM_MESSAGE_VERSION_12;
281+
spdm_response->header.request_response_code = SPDM_VENDOR_DEFINED_RESPONSE;
282+
spdm_response->header.param1 = 0;
283+
spdm_response->header.param2 = 0;
284+
285+
spdm_response->standard_id = 6;
286+
spdm_response->len = 2;
287+
}
288+
262289
libspdm_return_t libspdm_requester_chunk_get_test_send_message(
263290
void* spdm_context, size_t request_size, const void* request,
264291
uint64_t timeout)
@@ -431,6 +458,9 @@ libspdm_return_t libspdm_requester_chunk_get_test_receive_message(
431458
} else if (spdm_test_context->case_id == 0x4) {
432459
build_response_func =
433460
libspdm_requester_chunk_get_test_case4_build_digest_response;
461+
} else if (spdm_test_context->case_id == 0x5) {
462+
build_response_func =
463+
libspdm_requester_chunk_get_test_case5_build_vendor_response;
434464
} else {
435465
LIBSPDM_ASSERT(0);
436466
return LIBSPDM_STATUS_RECEIVE_FAIL;
@@ -453,6 +483,12 @@ libspdm_return_t libspdm_requester_chunk_get_test_receive_message(
453483

454484
sub_rsp = (spdm_message_header_t*) m_libspdm_local_large_response_buffer;
455485
sub_rsp_size = sizeof(m_libspdm_local_large_response_buffer);
486+
if (spdm_test_context->case_id == 0x5) {
487+
sub_rsp =
488+
(spdm_message_header_t*)
489+
m_libspdm_local_response_buffer_for_chunk_seq_no_wrap_test;
490+
sub_rsp_size = sizeof(m_libspdm_local_response_buffer_for_chunk_seq_no_wrap_test);
491+
}
456492
libspdm_zero_mem(sub_rsp, sub_rsp_size);
457493

458494
build_response_func(spdm_context, sub_rsp, &sub_rsp_size);
@@ -832,6 +868,57 @@ void libspdm_test_requester_chunk_get_case4(void** state)
832868
}
833869
#endif
834870

871+
#if LIBSPDM_ENABLE_VENDOR_DEFINED_MESSAGES
872+
static void libspdm_test_requester_chunk_get_case5(void **state)
873+
{
874+
/* Copied from Vendor Request case 1*/
875+
libspdm_return_t status;
876+
libspdm_test_context_t *spdm_test_context;
877+
libspdm_context_t *spdm_context;
878+
879+
uint16_t standard_id = 6;
880+
uint8_t vendor_id_len = 2;
881+
uint8_t vendor_id[SPDM_MAX_VENDOR_ID_LENGTH] = {0xAA, 0xAA};
882+
uint16_t data_len = 16;
883+
uint8_t data[16];
884+
885+
spdm_test_context = *state;
886+
spdm_context = spdm_test_context->spdm_context;
887+
spdm_test_context->case_id = 0x5;
888+
spdm_context->connection_info.version = SPDM_MESSAGE_VERSION_12 <<
889+
SPDM_VERSION_NUMBER_SHIFT_BIT;
890+
/* Large response need a large scratch buffer. */
891+
spdm_context->connection_info.capability.max_spdm_msg_size =
892+
BUFFER_SIZE_FOR_CHUNK_SEQ_NO_WRAP_TEST;
893+
spdm_context->local_context.capability.max_spdm_msg_size =
894+
BUFFER_SIZE_FOR_CHUNK_SEQ_NO_WRAP_TEST;
895+
spdm_context->connection_info.connection_state =
896+
LIBSPDM_CONNECTION_STATE_NEGOTIATED;
897+
spdm_context->connection_info.capability.data_transfer_size =
898+
CHUNK_GET_REQUESTER_UNIT_TEST_DATA_TRANSFER_SIZE;
899+
spdm_context->local_context.capability.sender_data_transfer_size =
900+
CHUNK_GET_REQUESTER_UNIT_TEST_DATA_TRANSFER_SIZE;
901+
spdm_context->local_context.is_requester = true;
902+
903+
spdm_test_context->scratch_buffer_size =
904+
libspdm_get_sizeof_required_scratch_buffer(spdm_context);
905+
spdm_test_context->scratch_buffer = (void *)malloc(spdm_test_context->scratch_buffer_size);
906+
libspdm_set_scratch_buffer (spdm_context,
907+
spdm_test_context->scratch_buffer,
908+
spdm_test_context->scratch_buffer_size);
909+
910+
libspdm_set_mem(data, sizeof(data), 0xAA);
911+
912+
status = libspdm_vendor_send_request_receive_response(spdm_context, NULL,
913+
standard_id, vendor_id_len, vendor_id,
914+
data_len, data,
915+
&standard_id, &vendor_id_len, vendor_id,
916+
&data_len, data);
917+
918+
assert_int_equal(status, LIBSPDM_STATUS_RECEIVE_FAIL);
919+
}
920+
#endif /* LIBSPDM_ENABLE_VENDOR_DEFINED_MESSAGES */
921+
835922
int libspdm_requester_chunk_get_test_main(void)
836923
{
837924
/* Test the CHUNK_GET handlers in various requester handlers */
@@ -851,6 +938,10 @@ int libspdm_requester_chunk_get_test_main(void)
851938
#if LIBSPDM_SEND_GET_CERTIFICATE_SUPPORT
852939
/* Request Digests */
853940
cmocka_unit_test(libspdm_test_requester_chunk_get_case4),
941+
#endif
942+
#if LIBSPDM_ENABLE_VENDOR_DEFINED_MESSAGES
943+
/* Request Vendor Specific Response and chunk seq no wrapped */
944+
cmocka_unit_test(libspdm_test_requester_chunk_get_case5),
854945
#endif
855946
};
856947

0 commit comments

Comments
 (0)