vtpmmgr: Check req_len before unpacking command

vtpm_handle_cmd doesn't ensure there is enough space before unpacking
the req buffer.  Add a minimum size check.  Called functions will have
to do their own checking if they need more data from the request.

The error case is tricky since abort_egress wants to rely with a
corresponding tag.  Just hardcode TPM_TAG_RQU_COMMAND since the vtpm is
sending in malformed commands in the first place.

Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Daniel P. Smith <dpsmith@apertussolutions.com>

stubdom/vtpmmgr/vtpm_cmd_handler.c

@@ -840,6 +840,12 @@ TPM_RESULT vtpmmgr_handle_cmd(
 	UINT32 size;
 	TPM_COMMAND_CODE ord;
 
+	if (tpmcmd->req_len < sizeof_TPM_RQU_HEADER(tpmcmd->req)) {
+		status = TPM_BAD_PARAMETER;
+		tag = TPM_TAG_RQU_COMMAND;
+		goto abort_egress;
+	}
+
 	unpack_TPM_RQU_HEADER(tpmcmd->req,
 			&tag, &size, &ord);