[automerger] Remove potential double free am: 9d4b635922 am: 85e5167178 am: 4dd7a24475 am: 0573a65f08 am: 93ba1512a8 am: aafa29b59c am: 564b0eae9f am: f68302d93b
am: 10f9d7dbe3

Change-Id: Ie86350d857d4b51e5b4c77d56208459f09d0e73d

gatekeeper.cpp

diff --git a/gatekeeper.cpp b/gatekeeper.cpp
index fe427bd..9097491 100644
--- a/gatekeeper.cpp
+++ b/gatekeeper.cpp
@@ -37,6 +37,10 @@
         // Password handle does not match what is stored, generate new SecureID
         GetRandom(&user_id, sizeof(secure_id_t));
     } else {
+        if (request.password_handle.length < sizeof(password_handle_t)) {
+            response->error = ERROR_INVALID;
+            return;
+        }
         password_handle_t *pw_handle =
             reinterpret_cast<password_handle_t *>(request.password_handle.buffer.get());
 
@@ -109,6 +113,11 @@
         return;
     }
 
+    if (request.password_handle.length < sizeof(password_handle_t)) {
+        response->error = ERROR_INVALID;
+        return;
+    }
+
     password_handle_t *password_handle = reinterpret_cast<password_handle_t *>(
             request.password_handle.buffer.get());
 
@@ -232,7 +241,7 @@
     token->challenge = challenge;
     token->user_id = user_id;
     token->authenticator_id = authenticator_id;
-    token->authenticator_type = htonl(HW_AUTH_PASSWORD);
+    token->authenticator_type = htobe32(HW_AUTH_PASSWORD);
     token->timestamp = htobe64(timestamp);
 
     const uint8_t *auth_token_key = NULL;
@@ -253,11 +262,11 @@
  * Calculates the timeout in milliseconds as a function of the failure
  * counter 'x' as follows:
  *
- * [0. 5) -> 0
+ * [0, 4] -> 0
  * 5 -> 30
- * [6, 10) -> 0
- * [11, 30) -> 30
- * [30, 140) -> 30 * (2^((x - 30)/10))
+ * [6, 10] -> 0
+ * [11, 29] -> 30
+ * [30, 139] -> 30 * (2^((x - 30)/10))
  * [140, inf) -> 1 day
  *
  */

gatekeeper_messages.cpp

diff --git a/gatekeeper_messages.cpp b/gatekeeper_messages.cpp
index d6d028d..dfa9b18 100644
--- a/gatekeeper_messages.cpp
+++ b/gatekeeper_messages.cpp
@@ -103,18 +103,21 @@
 }
 
 gatekeeper_error_t GateKeeperMessage::Deserialize(const uint8_t *payload, const uint8_t *end) {
-    if (payload + sizeof(uint32_t) > end) return ERROR_INVALID;
+    if (payload + sizeof(serial_header_t) > end) return ERROR_INVALID;
     const serial_header_t *header = reinterpret_cast<const serial_header_t *>(payload);
+    payload += sizeof(serial_header_t);
+    user_id = header->user_id;
     if (header->error == ERROR_NONE) {
-        if (payload == end) return ERROR_INVALID;
-        user_id = header->user_id;
-        error = nonErrorDeserialize(payload + sizeof(*header), end);
+        error = nonErrorDeserialize(payload, end);
     } else {
         error = static_cast<gatekeeper_error_t>(header->error);
-        user_id = header->user_id;
         if (error == ERROR_RETRY) {
-            if (payload + sizeof(serial_header_t) < end) {
-                memcpy(&retry_timeout, payload + sizeof(serial_header_t), sizeof(retry_timeout));
+            if (payload < end) {
+                if (payload + sizeof(retry_timeout) <= end) {
+                    memcpy(&retry_timeout, payload, sizeof(retry_timeout));
+                } else {
+                    error = ERROR_INVALID;
+                }
             } else {
                 retry_timeout = 0;
             }
@@ -179,6 +182,9 @@
         provided_password.buffer.reset();
     }
 
+    if (payload + sizeof(challenge) > end) {
+        return ERROR_INVALID;
+    }
     memcpy(&challenge, payload, sizeof(challenge));
     payload += sizeof(challenge);
 
@@ -231,6 +237,10 @@
         return err;
     }
 
+    if (payload + sizeof(request_reenroll) > end) {
+        return ERROR_INVALID;
+    }
+
     memcpy(&request_reenroll, payload, sizeof(request_reenroll));
     return ERROR_NONE;
 }

rules.mk

diff --git a/rules.mk b/rules.mk
index 46f3df8..831c05a 100644
--- a/rules.mk
+++ b/rules.mk
@@ -14,7 +14,6 @@
 	$(LOCAL_DIR)/../../hardware/libhardware/include
 
 MODULE_DEPS := \
-	lib/libc \
-	lib/libc-trusty \
+	trusty/user/base/lib/libc-trusty \
 
 include make/module.mk

tests/gatekeeper_device_test.cpp

diff --git a/tests/gatekeeper_device_test.cpp b/tests/gatekeeper_device_test.cpp
index 0e7ace6..f166ca8 100644
--- a/tests/gatekeeper_device_test.cpp
+++ b/tests/gatekeeper_device_test.cpp
@@ -98,7 +98,7 @@
     hat = reinterpret_cast<hw_auth_token_t *>(auth_token);
 
     ASSERT_EQ(HW_AUTH_TOKEN_VERSION, hat->version);
-    ASSERT_EQ(htonl(HW_AUTH_PASSWORD), hat->authenticator_type);
+    ASSERT_EQ(htobe32(HW_AUTH_PASSWORD), hat->authenticator_type);
 }
 
 TEST_F(GateKeeperDeviceTest, EnrollAndVerifyTimeout) {