[ujson,perso_tlv,dice] Fix potential signed integer flow, and add buffer checks

[anthonychen1251]

This PR has three commits that:

1. Fixes a potential integer overflow in ujson_parse_integer by using an unsigned integer for parsing and adding a check before converting back to a signed integer.
2. Adds buffer size checks in perso_tlv_data.c to prevent potential memory corruption vulnerabilities.
3. Removes the unused cert_size output parameter in dice_cert_check_valid

[sasdf]

I think we should check the cert_body_size before calling the check_serial_number?

[anthonychen1251]

To clarify, are you proposing we compare the cert_obj->cert_body_size with the decoded size of the header using cert_x509_asn1_decode_size_header(&cert_obj->cert_body_p[0])?

[sasdf]

I'm referring a check that ensure the body size is at least the minimum size required by cert_x509_asn1_check_serial_number, since that function doesn't take a size argument.

[anthonychen1251]

Correct me if I'm wrong, but isn't that check already included in

opentitan/sw/device/silicon_creator/lib/cert/cert.c

Lines 54 to 62 in 7240b02

	uint32_t cert_size =
	cert_x509_asn1_decode_size_header(&cert_page_buffer[offset]);
	if (out_cert_size != NULL) {
	*out_cert_size = cert_size;
	}
	if (launder32(cert_size) < kCertX509Asn1FirstBytesWithSerialNumber) {
	HARDENED_CHECK_LT(cert_size, kCertX509Asn1FirstBytesWithSerialNumber);
	return kErrorOk;
	}

? Although it will return kErrorOk when the size is not large enough to include a serial number.

The snippet below performs a sanity check on the certificate body size when populating the perso tlv object.

opentitan/sw/device/silicon_creator/manuf/base/perso_tlv_data.c

Lines 62 to 75 in 7240b02

	// Set pointer to certificate body.
	obj->cert_body_size =
	wrapped_cert_size - sizeof(perso_tlv_cert_header_t) - name_len;
	obj->cert_body_p = buf;
	// Sanity check on the certificate body size.
	// TODO(24281): add sanity check on CWT certificate body size.
	if (obj_type == kPersoObjectTypeX509Cert) {
	size_t decoded_cert_size =
	cert_x509_asn1_decode_size_header(obj->cert_body_p);
	if (decoded_cert_size != obj->cert_body_size) {
	return kErrorPersoTlvInternal;
	}
	}

That's why I asked if you were proposing we compare cert_obj->cert_body_size with cert_x509_asn1_decode_size_header(&cert_obj->cert_body_p[0]) (how cert_x509_asn1_check_serial_number() get the cert size actually ) here

[sasdf]

Offline discussion with Anthony confirmed existing checks are sufficient, but moving the checks to make cert_x509_asn1_check_serial_number and its deps aware of the TLV buffer length is still more preferred. Also, with the ongoing cert template engine change, further simplification is possible to save space.

We will address it in a follow-up PR, and the current implementation remains for now.

[timothytrippel]

LGTM, thanks @anthonychen1251

Can you rebase this on the latest tip of tree to ensure it passes CI checks (since it is a bit stale?), and then also cherry-pick this to the earlgrey_1.0.0 branch when you have a moment?

[github-actions]

Successfully created backport PR for earlgrey_1.0.0:

• Cherry-pick to earlgrey_1.0.0: [ujson,perso_tlv,dice] Fix potential signed integer flow, and add buffer checks #26104