1 /*
2 * Copyright 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <keymaster/serializable.h>
18
19 #include <assert.h>
20
21 #include <keymaster/new.h>
22
23 #include <keymaster/android_keymaster_utils.h>
24
25 namespace keymaster {
26
27 namespace {
28
29 /* Performs an overflow-checked bounds check */
buffer_bound_check(const uint8_t * buf,const uint8_t * end,size_t len)30 bool buffer_bound_check(const uint8_t* buf, const uint8_t* end, size_t len) {
31 uintptr_t buf_next;
32 bool overflow_occurred = __builtin_add_overflow(__pval(buf), len, &buf_next);
33 return (!overflow_occurred) && (buf_next <= __pval(end));
34 }
35
36 }
37
append_to_buf(uint8_t * buf,const uint8_t * end,const void * data,size_t data_len)38 uint8_t* append_to_buf(uint8_t* buf, const uint8_t* end, const void* data, size_t data_len) {
39 if (buffer_bound_check(buf, end, data_len)) {
40 memcpy(buf, data, data_len);
41 return buf + data_len;
42 } else {
43 return buf;
44 }
45 }
46
copy_from_buf(const uint8_t ** buf_ptr,const uint8_t * end,void * dest,size_t size)47 bool copy_from_buf(const uint8_t** buf_ptr, const uint8_t* end, void* dest, size_t size) {
48 if (buffer_bound_check(*buf_ptr, end, size)) {
49 memcpy(dest, *buf_ptr, size);
50 *buf_ptr += size;
51 return true;
52 } else {
53 return false;
54 }
55 }
56
copy_size_and_data_from_buf(const uint8_t ** buf_ptr,const uint8_t * end,size_t * size,UniquePtr<uint8_t[]> * dest)57 bool copy_size_and_data_from_buf(const uint8_t** buf_ptr, const uint8_t* end, size_t* size,
58 UniquePtr<uint8_t[]>* dest) {
59 if (!copy_uint32_from_buf(buf_ptr, end, size))
60 return false;
61
62 if (*size == 0) {
63 dest->reset();
64 return true;
65 }
66
67 if (buffer_bound_check(*buf_ptr, end, *size)) {
68 dest->reset(new (std::nothrow) uint8_t[*size]);
69 if (!dest->get()) {
70 return false;
71 }
72 return copy_from_buf(buf_ptr, end, dest->get(), *size);
73 } else {
74 return false;
75 }
76 }
77
reserve(size_t size)78 bool Buffer::reserve(size_t size) {
79 if (available_write() < size) {
80 size_t new_size = buffer_size_ + size - available_write();
81 uint8_t* new_buffer = new (std::nothrow) uint8_t[new_size];
82 if (!new_buffer)
83 return false;
84 memcpy(new_buffer, buffer_.get() + read_position_, available_read());
85 memset_s(buffer_.get(), 0, buffer_size_);
86 buffer_.reset(new_buffer);
87 buffer_size_ = new_size;
88 write_position_ -= read_position_;
89 read_position_ = 0;
90 }
91 return true;
92 }
93
Reinitialize(size_t size)94 bool Buffer::Reinitialize(size_t size) {
95 Clear();
96 buffer_.reset(new (std::nothrow) uint8_t[size]);
97 if (!buffer_.get())
98 return false;
99 buffer_size_ = size;
100 read_position_ = 0;
101 write_position_ = 0;
102 return true;
103 }
104
Reinitialize(const void * data,size_t data_len)105 bool Buffer::Reinitialize(const void* data, size_t data_len) {
106 Clear();
107 if (__pval(data) + data_len < __pval(data)) // Pointer wrap check
108 return false;
109 buffer_.reset(new (std::nothrow) uint8_t[data_len]);
110 if (!buffer_.get())
111 return false;
112 buffer_size_ = data_len;
113 memcpy(buffer_.get(), data, data_len);
114 read_position_ = 0;
115 write_position_ = buffer_size_;
116 return true;
117 }
118
available_write() const119 size_t Buffer::available_write() const {
120 assert(buffer_size_ >= write_position_);
121 return buffer_size_ - write_position_;
122 }
123
available_read() const124 size_t Buffer::available_read() const {
125 assert(buffer_size_ >= write_position_);
126 assert(write_position_ >= read_position_);
127 return write_position_ - read_position_;
128 }
129
write(const uint8_t * src,size_t write_length)130 bool Buffer::write(const uint8_t* src, size_t write_length) {
131 if (available_write() < write_length)
132 return false;
133 memcpy(buffer_.get() + write_position_, src, write_length);
134 write_position_ += write_length;
135 return true;
136 }
137
read(uint8_t * dest,size_t read_length)138 bool Buffer::read(uint8_t* dest, size_t read_length) {
139 if (available_read() < read_length)
140 return false;
141 memcpy(dest, buffer_.get() + read_position_, read_length);
142 read_position_ += read_length;
143 return true;
144 }
145
SerializedSize() const146 size_t Buffer::SerializedSize() const {
147 return sizeof(uint32_t) + available_read();
148 }
149
Serialize(uint8_t * buf,const uint8_t * end) const150 uint8_t* Buffer::Serialize(uint8_t* buf, const uint8_t* end) const {
151 return append_size_and_data_to_buf(buf, end, peek_read(), available_read());
152 }
153
Deserialize(const uint8_t ** buf_ptr,const uint8_t * end)154 bool Buffer::Deserialize(const uint8_t** buf_ptr, const uint8_t* end) {
155 Clear();
156 if (!copy_size_and_data_from_buf(buf_ptr, end, &buffer_size_, &buffer_)) {
157 buffer_.reset();
158 buffer_size_ = 0;
159 return false;
160 }
161 write_position_ = buffer_size_;
162 return true;
163 }
164
Clear()165 void Buffer::Clear() {
166 memset_s(buffer_.get(), 0, buffer_size_);
167 buffer_.reset();
168 read_position_ = 0;
169 write_position_ = 0;
170 buffer_size_ = 0;
171 }
172
173 } // namespace keymaster
174