libckteec: fix CKA_ALLOWED_MECHANISMS size on 64-bit

On 64-bit systems, CKA_ALLOWED_MECHANISMS deserialization reports
the wire format size (count * sizeof(uint32_t)) instead of the
CK_ULONG-based size (count * sizeof(CK_ULONG)). This causes the
standard PKCS#11 size-query pattern to allocate a buffer that is
too small, leading to a heap buffer overflow when the mechanisms
are written as CK_ULONG values.

Fix the size reporting and buffer guard in deserialize_ck_attribute()
to use CK_ULONG-based sizes for CKA_ALLOWED_MECHANISMS, and fix the
buffer advancement in deserialize_ck_attributes() to match the wire
format size.

Signed-off-by: Minghao Cheng <m@minhal.me>
Reviewed-by: Jens Wiklander <jens.wiklander@oss.qualcomm.com>
Acked-by: Jerome Forissier <jerome.forissier@arm.com>

Author: bestminhal

libckteec/src/serialize_ck.c

@@ -288,6 +288,20 @@ static CK_RV deserialize_ck_attribute(struct pkcs11_attribute_head *in,
 		return CKR_OK;
 	}
 
+	if (out->type == CKA_ALLOWED_MECHANISMS) {
+		CK_ULONG ck_size = (in->size / sizeof(uint32_t)) *
+				    sizeof(CK_ULONG);
+
+		if (!out->pValue) {
+			out->ulValueLen = ck_size;
+			return CKR_OK;
+		}
+		if (out->ulValueLen < ck_size) {
+			out->ulValueLen = ck_size;
+			return CKR_OK;
+		}
+	}
+
 	if (out->ulValueLen < in->size) {
 		out->ulValueLen = in->size;
 		return CKR_OK;
@@ -363,6 +377,10 @@ CK_RV deserialize_ck_attributes(uint8_t *in, CK_ATTRIBUTE_PTR attributes,
 		if (cur_attr->pValue) {
 			if (ck_attr_is_ulong(cur_attr->type))
 				len += sizeof(uint32_t);
+			else if (cur_attr->type == CKA_ALLOWED_MECHANISMS)
+				len += (cur_attr->ulValueLen /
+					sizeof(CK_ULONG)) *
+				       sizeof(uint32_t);
 			else
 				len += cur_attr->ulValueLen;
 		}