Using tpm2_ptool verify --sopin leads to local variable referenced before assignment

[fishilico]

Hello,
While testing some arguments of tpm2_ptool, I encountered the following error:

$ ./tpm2_ptool verify --sopin $PIN --label tpm-ssh1
Traceback (most recent call last):
  File "/usr/lib/python3.8/runpy.py", line 194, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/lib/python3.8/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/home/user/github/tpm2-pkcs11/tools/tpm2_pkcs11/tpm2_ptool.py", line 30, in <module>
    main()
  File "/home/user/github/tpm2-pkcs11/tools/tpm2_pkcs11/tpm2_ptool.py", line 26, in main
    commandlet.init('A tool for manipulating the tpm2-pkcs11 database')
  File "/home/user/github/tpm2-pkcs11/tools/tpm2_pkcs11/command.py", line 102, in init
    commandlet.get()[d['which']](d)
  File "/home/user/github/tpm2-pkcs11/tools/tpm2_pkcs11/commandlets_token.py", line 181, in __call__
    VerifyCommand.verify(db, args)
  File "/home/user/github/tpm2-pkcs11/tools/tpm2_pkcs11/commandlets_token.py", line 136, in verify
    'auth' : usersealauth['hash']
UnboundLocalError: local variable 'usersealauth' referenced before assignment

There is a bug in

tpm2-pkcs11/tools/tpm2_pkcs11/commandlets_token.py

Lines 104 to 137 in a9d7b81

	if sopin != None:
	sosealctx = tpm2.load(pobj_handle, pobjauth,
	sealobj['sopriv'], sealobj['sopub'])
	# Unseal the wrapping key auth
	sosealauthsalt = sealobj['soauthsalt']
	sosealauth = hash_pass(sopin, salt=sosealauthsalt)
	wrappingkeyauth = tpm2.unseal(sosealctx, sosealauth['hash'])
	verify_output['pin']['so'] = {'seal-auth' : sosealauth['hash'] }
	if userpin != None:
	usersealctx = tpm2.load(pobj_handle, pobjauth,
	sealobj['userpriv'],
	sealobj['userpub'])
	# Unseal the wrapping key auth
	usersealauthsalt = sealobj['userauthsalt']
	usersealauth = hash_pass(userpin, salt=usersealauthsalt)
	wrappingkeyauth = tpm2.unseal(usersealctx,
	usersealauth['hash'])
	verify_output['pin']['user'] = {'seal-auth' : usersealauth['hash'] }
	verify_output['wrappingkey'] = {
	'hex' : bytes.hex(wrappingkeyauth),
	'auth' : usersealauth['hash']
	}

When sopin != None and userpin is None, sosealauth is set but not usersealauth and then on line 136, usersealauth is used while being uninitialized.