fix passing key out of LoadFirmware

firmware/lib/vboot_firmware.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * High-level firmware API for loading and verifying rewritable firmware.
  * (Firmware portion)
  */
 
 #include "load_firmware_fw.h"
 #include "rollback_index.h"
@@ skipping 27 matching lines @@
 
   uint16_t tpm_key_version = 0;
   uint16_t tpm_fw_version = 0;
   uint64_t lowest_key_version = 0xFFFF;
   uint64_t lowest_fw_version = 0xFFFF;
   int good_index = -1;
   int index;
 
   /* Clear output params in case we fail */
   params->firmware_index = 0;
-  params->kernel_sign_key_blob = NULL;
-  params->kernel_sign_key_size = 0;
 
   debug("LoadFirmware started...\n");
 
+  if (params->kernel_sign_key_size < sizeof(VbPublicKey)) {
+    debug("Kernel sign key buffer too small\n");
+    return LOAD_FIRMWARE_RECOVERY;
+  }
+
   /* Must have a root key */
   if (!root_key) {
     debug("No root key\n");
     return LOAD_FIRMWARE_RECOVERY;
   }
 
   /* Initialize the TPM and read rollback indices. */
   /* TODO: fix SetupTPM parameter for developer mode */
   if (0 != RollbackFirmwareSetup(0, &tpm_key_version, &tpm_fw_version)) {
     debug("Unable to get stored versions.\n");
@@ skipping 164 matching lines @@
 
     /* Success */
     debug("Will boot firmware index %d\n", (int)params->firmware_index);
     return LOAD_FIRMWARE_SUCCESS;
   }
 
   /* If we're still here, no good firmware, so go to recovery mode. */
   debug("Alas, no good firmware.\n");
   return LOAD_FIRMWARE_RECOVERY;
 }