diff options
| -rw-r--r-- | src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c | 3 | ||||
| -rw-r--r-- | src/cryptsetup/cryptsetup-tpm2.c | 4 | ||||
| -rw-r--r-- | src/shared/tpm2-util.c | 1 |
3 files changed, 6 insertions, 2 deletions
diff --git a/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c b/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c index 80a2c0d316..c4377230ca 100644 --- a/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c +++ b/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c @@ -38,6 +38,7 @@ int acquire_luks2_key( _cleanup_(erase_and_freep) char *b64_salted_pin = NULL; int r; + assert(salt || salt_size == 0); assert(ret_decrypted_key); assert(ret_decrypted_key_size); @@ -58,7 +59,7 @@ int acquire_luks2_key( if ((flags & TPM2_FLAGS_USE_PIN) && salt && !pin) return -ENOANO; - if (pin) { + if (pin && salt_size > 0) { uint8_t salted_pin[SHA256_DIGEST_SIZE] = {}; CLEANUP_ERASE(salted_pin); r = tpm2_util_pbkdf2_hmac_sha256(pin, strlen(pin), salt, salt_size, salted_pin); diff --git a/src/cryptsetup/cryptsetup-tpm2.c b/src/cryptsetup/cryptsetup-tpm2.c index 2a8a38c593..a375a22758 100644 --- a/src/cryptsetup/cryptsetup-tpm2.c +++ b/src/cryptsetup/cryptsetup-tpm2.c @@ -86,6 +86,8 @@ int acquire_tpm2_key( const void *blob; int r; + assert(salt || salt_size == 0); + if (!device) { r = tpm2_find_device_auto(LOG_DEBUG, &auto_device); if (r == -ENODEV) @@ -152,7 +154,7 @@ int acquire_tpm2_key( if (r < 0) return r; - if (salt) { + if (salt_size > 0) { uint8_t salted_pin[SHA256_DIGEST_SIZE] = {}; CLEANUP_ERASE(salted_pin); diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index 6552e66bf4..259f280e0f 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -2487,6 +2487,7 @@ int tpm2_util_pbkdf2_hmac_sha256(const void *pass, */ static const uint8_t block_cnt[] = { 0, 0, 0, 1 }; + assert (salt); assert (saltlen > 0); assert (saltlen <= (SIZE_MAX - sizeof(block_cnt))); assert (passlen > 0); |