Check buffer lengths and HMAC return value in crypto.c
I've made sure that buffer lengths are consistently checked, and that the return value of HMAC is checked in crypto.c.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information