corePKCS11 icon indicating copy to clipboard operation
corePKCS11 copied to clipboard

C_GetAttributeValue does not set the attribute length in all cases

Open sbertin-telular opened this issue 2 years ago • 1 comments

The attribute length is only set when the pointer is NULL. It should also be set in cases where the buffer is too large or too small.

From PKCS11-base-v2.40: For each (type, pValue, ulValueLen) triple in the template, C_GetAttributeValue performs the following algorithm:

  1. If the specified attribute (i.e., the attribute specified by the type field) for the object cannot be revealed because the object is sensitive or unextractable, then the ulValueLen field in that triple is modified to hold the value CK_UNAVAILABLE_INFORMATION.
  2. Otherwise, if the specified value for the object is invalid (the object does not possess such an attribute), then the ulValueLen field in that triple is modified to hold the value CK_UNAVAILABLE_INFORMATION.
  3. Otherwise, if the pValue field has the value NULL_PTR, then the ulValueLen field is modified to hold the exact length of the specified attribute for the object.
  4. Otherwise, if the length specified in ulValueLen is large enough to hold the value of the specified attribute for the object, then that attribute is copied into the buffer located at pValue, and the ulValueLen field is modified to hold the exact length of the attribute.
  5. Otherwise, the ulValueLen field is modified to hold the value CK_UNAVAILABLE_INFORMATION.

sbertin-telular avatar Mar 13 '23 14:03 sbertin-telular

@sbertin-telular Thanks for the report. I will take a look.

paulbartell avatar Mar 13 '23 19:03 paulbartell

@sbertin-telular I have created a pull request #193 to address this issue, and I would like to invite you to review the proposed changes to see if they adequately resolve the issue.

chinglee-iot avatar May 10 '24 10:05 chinglee-iot

The PR to address this problem is merged. We will close this issue. Feel free to reopen it if any further question.

chinglee-iot avatar May 13 '24 08:05 chinglee-iot