lib: reserve some pointer-sized fields

Changing any uint64_t reserved fields to pointers later would require
some tricks to avoid breaking the ABI on 32-bit systems.  To avoid this,
reserve some pointer-sized fields too.

Signed-off-by: Eric Biggers <ebiggers@google.com>

5 files changed, 30 insertions, 14 deletions

diff --git a/common/libfsverity.h b/common/libfsverity.h
index 8e8571a..f3f6165 100644
--- a/common/libfsverity.h
+++ b/common/libfsverity.h
@@ -23,7 +23,8 @@ struct libfsverity_merkle_tree_params {
 	uint32_t salt_size;		/* salt size in bytes (0 if unsalted) */
 	uint64_t file_size;		/* file size in bytes		*/
 	const uint8_t *salt;		/* pointer to salt (optional)	*/
-	uint64_t reserved[11];		/* must be 0			*/
+	uint64_t reserved1[8];		/* must be 0 */
+	uintptr_t reserved2[8];		/* must be 0 */
 };
 
 struct libfsverity_digest {
@@ -35,7 +36,8 @@ struct libfsverity_digest {
 struct libfsverity_signature_params {
 	const char *keyfile;		/* path to key file (PEM format) */
 	const char *certfile;		/* path to certificate (PEM format) */
-	uint64_t reserved[11];		/* must be 0 */
+	uint64_t reserved1[8];		/* must be 0 */
+	uintptr_t reserved2[8];		/* must be 0 */
 };
 
 /*
diff --git a/lib/compute_digest.c b/lib/compute_digest.c
index e41b23b..52566a8 100644
--- a/lib/compute_digest.c
+++ b/lib/compute_digest.c
@@ -164,7 +164,6 @@ libfsverity_compute_digest(void *fd, libfsverity_read_fn_t read_fn,
 	struct hash_ctx *hash = NULL;
 	struct libfsverity_digest *digest;
 	struct fsverity_descriptor desc;
-	int i;
 	int err;
 
 	if (!read_fn || !params || !digest_ret) {
@@ -190,11 +189,12 @@ libfsverity_compute_digest(void *fd, libfsverity_read_fn_t read_fn,
 		libfsverity_error_msg("salt_size specified, but salt is NULL");
 		return -EINVAL;
 	}
-	for (i = 0; i < ARRAY_SIZE(params->reserved); i++) {
-		if (params->reserved[i]) {
-			libfsverity_error_msg("reserved bits set in merkle_tree_params");
-			return -EINVAL;
-		}
+	if (!libfsverity_mem_is_zeroed(params->reserved1,
+				       sizeof(params->reserved1)) ||
+	    !libfsverity_mem_is_zeroed(params->reserved2,
+				       sizeof(params->reserved2))) {
+		libfsverity_error_msg("reserved bits set in merkle_tree_params");
+		return -EINVAL;
 	}
 
 	hash_alg = libfsverity_find_hash_alg_by_num(params->hash_algorithm);
diff --git a/lib/lib_private.h b/lib/lib_private.h
index 998d765..dc8448d 100644
--- a/lib/lib_private.h
+++ b/lib/lib_private.h
@@ -80,4 +80,6 @@ libfsverity_bug_on(const char *condition, const char *file, int line);
 	c;								\
 })
 
+bool libfsverity_mem_is_zeroed(const void *mem, size_t size);
+
 #endif /* LIB_LIB_PRIVATE_H */
diff --git a/lib/sign_digest.c b/lib/sign_digest.c
index 218085d..af260af 100644
--- a/lib/sign_digest.c
+++ b/lib/sign_digest.c
@@ -331,7 +331,6 @@ libfsverity_sign_digest(const struct libfsverity_digest *digest,
 			const struct libfsverity_signature_params *sig_params,
 			u8 **sig_ret, size_t *sig_size_ret)
 {
-	int i;
 	const struct fsverity_hash_alg *hash_alg;
 	EVP_PKEY *pkey = NULL;
 	X509 *cert = NULL;
@@ -349,11 +348,12 @@ libfsverity_sign_digest(const struct libfsverity_digest *digest,
 		return -EINVAL;
 	}
 
-	for (i = 0; i < ARRAY_SIZE(sig_params->reserved); i++) {
-		if (sig_params->reserved[i]) {
-			libfsverity_error_msg("reserved bits set in signature_params");
-			return -EINVAL;
-		}
+	if (!libfsverity_mem_is_zeroed(sig_params->reserved1,
+				       sizeof(sig_params->reserved1)) ||
+	    !libfsverity_mem_is_zeroed(sig_params->reserved2,
+				       sizeof(sig_params->reserved2))) {
+		libfsverity_error_msg("reserved bits set in signature_params");
+		return -EINVAL;
 	}
 
 	hash_alg = libfsverity_find_hash_alg_by_num(digest->digest_algorithm);
diff --git a/lib/utils.c b/lib/utils.c
index 53e4381..18cb34c 100644
--- a/lib/utils.c
+++ b/lib/utils.c
@@ -107,3 +107,15 @@ void libfsverity_bug_on(const char *condition, const char *file, int line)
 		"Non-recoverable, aborting program.\n", condition, file, line);
 	abort();
 }
+
+bool libfsverity_mem_is_zeroed(const void *mem, size_t size)
+{
+	const u8 *p = mem;
+	size_t i;
+
+	for (i = 0; i < size; i++) {
+		if (p[i])
+			return false;
+	}
+	return true;
+}