[dgarske]

Fixes for six Fenrir reports, one commit each.

• F-16218: a fwTPM policy session carrying a PolicyTemplate hash is accepted only for Create, CreatePrimary and CreateLoaded, as in the reference implementation.
• F-16220: the fwTPM TIS transport builds each response in a private buffer, and the dispatcher bounds the response parameter size by what the handler wrote.
• F-16827: secure_rot reuses an existing NV index only when its attributes, size, name algorithm and policy match what it would create, and prints the hash it reads in every build.
• F-16798: create_primary -eh -store= persists the key with owner authorization, since EvictControl takes the owner or platform hierarchy.
• F-16800: flush prints usage for -h/--help and rejects a non-numeric handle.
• F-16189: the wolfTPM2_Clear documentation now describes TPM2_Clear and points to wolfTPM2_Cleanup for deinitialization.

Tests: a fwTPM unit test for PolicyTemplate scoping, HAL tests for the TIS GO success and error responses, and run_examples.sh coverage for create_primary -eh -store, the flush arguments and rejection of a mismatched secure_rot index.

[Copilot]

🟡 Changes recommended

The private response buffer retains plaintext secrets without scrubbing, and handle validation after narrowing can allow malformed input to flush a real TPM object.

2 open issues

• Validate handle range before narrowing parsed values · New
• Zeroize the private response buffer before releasing it · New

What changed in this PR

This PR addresses six reported security and correctness issues in wolfTPM’s firmware TPM, command-line examples, and API documentation.

Changes:

• Restricts template-bound policy sessions to creation commands and isolates TIS response processing from shared memory.
• Validates existing secure-boot NV indices, corrects persistence authority selection, and improves flush argument handling.
• Adds regression coverage and clarifies that wolfTPM2_Clear performs a destructive TPM operation.

File	Description
wolftpm/​tpm2_wrap.h	Corrects wolfTPM2_Clear documentation and related links.
tests/​fwtpm_unit_tests.c	Adds PolicyTemplate authorization regression tests.
src/​fwtpm/​fwtpm_tis.c	Builds responses in a private buffer before copying them out.
src/​fwtpm/​fwtpm_command.c	Enforces template-policy scope and bounds response parameter lengths.
examples/​run_examples.sh	Adds endorsement-key persistence and flush argument checks.
examples/​management/​flush.c	Handles help explicitly and rejects malformed handles.
examples/​keygen/​create_primary.c	Selects owner or platform authority for key persistence.
examples/​boot/​secure_rot.c	Checks existing NV index properties before reuse.

_{Review effort: Balanced}

[embhorn]

Skoll Code Review

Scan type: review

Overall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] Check strtoul overflow on 32 bit targets — examples/management/flush.c:71-75
• [Medium] Qualify which NV indices Clear removes — wolftpm/tpm2_wrap.h:3656-3660
• [Medium] Cover rejection of mismatched existing ROT indices — examples/boot/secure_rot.c:235-244
• [Medium] Exercise the new TIS response staging path — src/fwtpm/fwtpm_tis.c:163-193

Review generated by Skoll