Repository navigation
Clear DIGESTS and RESPOND_IF_READY state in reset_context - #4199
Merged
Merged
Conversation
steven-bellock
changed the title
DIGESTS and RESPOND_IF_READY state in reset_context
libspdm_reset_context() left two pieces of the previous connection behind: the peer's DIGESTS results (slot masks, key_pair_id, cert_info, key_usage_bit_mask) and the RESPOND_IF_READY state, whose cached request bytes stayed in the scratch buffer in plaintext even for session-encrypted requests. error_data was never cleared, and it sits outside the LIBSPDM_RESPOND_IF_READY_SUPPORT guard. Zero the DIGESTS fields, erase the cached request across its whole scratch buffer capacity, reset its session ID fields, and clear error_data unconditionally. The new test_spdm_common case81 fills all of this state and verifies reset_context clears it. Fixes DMTF#4182 Assisted-by: Kimi:K2.8 Signed-off-by: Mark Tamas <marktamas28@gmail.com>
v1rtu3x
force-pushed
the
reset-context-clear-connection-state
branch
from
October 18, 2026 07:57
e53b619 to
a864acc
Compare
steven-bellock
approved these changes
Oct 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4182.
libspdm_reset_context()left two pieces of the previous connection behind:peer_provisioned_slot_mask,peer_supported_slot_mask,peer_key_pair_id[],peer_cert_info[],peer_key_usage_bit_mask[]error_datawas never cleared (it sits outside theLIBSPDM_RESPOND_IF_READY_SUPPORTguard)Zero the DIGESTS fields, erase the cached request across its whole scratch buffer capacity, reset its session ID fields, and clear
error_dataunconditionally.The new
test_spdm_commoncase81 fills all of this state and verifiesreset_contextclears it, byte by byte for the cached request buffer. It compiles and passes under bothLIBSPDM_RESPOND_IF_READY_SUPPORT=0and=1.Tested locally (GCC 14.2.0, x64, Debug): full battery (requester, responder, common, spdm_crypt, crypt, secured_message) with mbedtls and openssl, plus the CI feature matrix (all capabilities off / RECORD_TRANSCRIPT 0+FIPS 0 / RECORD_TRANSCRIPT 1+FIPS 1 incl.
test_spdm_fips). The case fails before the fix (0x5 != 0) and passes after.format_nix.sh --check,check_encode.sh,check_copyright_date.sh,check_commit_message.shpass.Happy to adjust anything — thanks for maintaining libspdm!