Coverity CID 910531/910532: bound decrypted seed length and clamp packet parse offset

src/fwtpm/fwtpm_command.c

@@ -8423,7 +8423,8 @@ static TPM_RC FwCmd_StartAuthSession(FWTPM_CTX* ctx, TPM2_Packet* cmd,
         }
         /* Then append salt if present */
         if (rc == 0 && saltSize > 0) {
-            if (keyInSz + saltSize <= (int)sizeof(keyIn)) {
+            if (keyInSz + saltSize <= (int)sizeof(keyIn) &&
+                saltSize <= (int)sizeof(salt)) {
                 XMEMCPY(keyIn + keyInSz, salt, saltSize);
                 keyInSz += saltSize;
             }

src/fwtpm/fwtpm_crypto.c

@@ -2447,6 +2447,11 @@ TPM_RC FwDecryptSeed(FWTPM_CTX* ctx,
                 TPM2_ForceZero(seedBuf, seedBufSz);
                 rc = TPM_RC_FAILURE;
             }
+            else if (rc > seedBufSz) {
+                /* Bound output to caller buffer */
+                TPM2_ForceZero(seedBuf, seedBufSz);
+                rc = TPM_RC_FAILURE;
+            }
             else {
                 *seedSzOut = rc;
                 rc = 0;

src/tpm2_packet.c

@@ -257,7 +257,13 @@ void TPM2_Packet_ParseBytes(TPM2_Packet* packet, byte* buf, int size)
                 XMEMCPY(buf, &packet->buf[packet->pos], sizeToCopy);
             }
         }
-        packet->pos += size;
+        if (size > 0 && packet->pos + size > packet->size) {
+            /* Clamp pos on truncated read */
+            packet->pos = packet->size;
+        }
+        else {
+            packet->pos += size;
+        }
     }
 }