From 12c587a4368f945e19cf34186930600f0f840f63 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Tue, 30 Jun 2026 07:29:42 -0700
Subject: [PATCH] Coverity CID 910531/910532: bound decrypted seed length and
 clamp packet parse offset

---
 src/fwtpm/fwtpm_command.c | 3 ++-
 src/fwtpm/fwtpm_crypto.c  | 5 +++++
 src/tpm2_packet.c         | 8 +++++++-
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/fwtpm/fwtpm_command.c b/src/fwtpm/fwtpm_command.c
index ac06cf0e..2d30f1a3 100644
--- a/src/fwtpm/fwtpm_command.c
+++ b/src/fwtpm/fwtpm_command.c
@@ -8423,7 +8423,8 @@ static TPM_RC FwCmd_StartAuthSession(FWTPM_CTX* ctx, TPM2_Packet* cmd,
         }
         /* Then append salt if present */
         if (rc == 0 && saltSize > 0) {
-            if (keyInSz + saltSize <= (int)sizeof(keyIn)) {
+            if (keyInSz + saltSize <= (int)sizeof(keyIn) &&
+                saltSize <= (int)sizeof(salt)) {
                 XMEMCPY(keyIn + keyInSz, salt, saltSize);
                 keyInSz += saltSize;
             }
diff --git a/src/fwtpm/fwtpm_crypto.c b/src/fwtpm/fwtpm_crypto.c
index 8c62f3e5..5b267f35 100644
--- a/src/fwtpm/fwtpm_crypto.c
+++ b/src/fwtpm/fwtpm_crypto.c
@@ -2447,6 +2447,11 @@ TPM_RC FwDecryptSeed(FWTPM_CTX* ctx,
                 TPM2_ForceZero(seedBuf, seedBufSz);
                 rc = TPM_RC_FAILURE;
             }
+            else if (rc > seedBufSz) {
+                /* Bound output to caller buffer */
+                TPM2_ForceZero(seedBuf, seedBufSz);
+                rc = TPM_RC_FAILURE;
+            }
             else {
                 *seedSzOut = rc;
                 rc = 0;
diff --git a/src/tpm2_packet.c b/src/tpm2_packet.c
index d44bf5a7..e4809fb3 100644
--- a/src/tpm2_packet.c
+++ b/src/tpm2_packet.c
@@ -257,7 +257,13 @@ void TPM2_Packet_ParseBytes(TPM2_Packet* packet, byte* buf, int size)
                 XMEMCPY(buf, &packet->buf[packet->pos], sizeToCopy);
             }
         }
-        packet->pos += size;
+        if (size > 0 && packet->pos + size > packet->size) {
+            /* Clamp pos on truncated read */
+            packet->pos = packet->size;
+        }
+        else {
+            packet->pos += size;
+        }
     }
 }