Fix collision in delete_object (same ids, different types)

wolfSSL · Aug 12, 2024 · 5b9278d · 5b9278d
1 parent 6bfdf0a
commit 5b9278d
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/src/pkcs11_store.c b/src/pkcs11_store.c
@@ -213,14 +213,15 @@ static void check_vault(void) {
     }
 }
 
-static void delete_object(uint32_t tok_id, uint32_t obj_id)
+static void delete_object(int32_t type, uint32_t tok_id, uint32_t obj_id)
 {
     struct obj_hdr *hdr = (struct obj_hdr *)cached_sector;
     check_vault();
     memcpy(cached_sector, vault_base, WOLFBOOT_SECTOR_SIZE);
 
     while ((uintptr_t)hdr < ((uintptr_t)cached_sector + WOLFBOOT_SECTOR_SIZE)) {
-        if ((hdr->token_id == tok_id) && (hdr->object_id == obj_id)) {
+        if ((hdr->token_id == tok_id) && (hdr->object_id == obj_id) && 
+                (hdr->type == type)) {
             hdr->token_id = PKCS11_INVALID_ID;
             hdr->object_id = PKCS11_INVALID_ID;
             bitmap_put(hdr->pos, 0);
@@ -255,7 +256,7 @@ static uint8_t *find_object_buffer(int32_t type, uint32_t tok_id, uint32_t obj_i
                     /* Found backup! restoring... */
                     restore_backup(sector_base);
                 } else {
-                    delete_object(tok_id, obj_id);
+                    delete_object(type, tok_id, obj_id);
                     return NULL; /* Cannot recover object payload */
                 }
             }