diff options
| author | Igor Opaniuk | 2024-04-21 22:48:39 +0200 |
|---|---|---|
| committer | Ilias Apalodimas | 2024-04-26 08:28:35 +0300 |
| commit | 8800cbe9b83bf15ca6dc43ca4b05269b3126526a (patch) | |
| tree | a81fc6c620614b74483b2f94f0172ee82ecf11ce /drivers/tee | |
| parent | d097f9e1299a3bdb7de468f0d9bbc63932f461cd (diff) | |
tee: sandbox: check for buffer size
Add additional check for buffer size when reading out persistent
storage value and provide back actual value size.
Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Oleksandr Suvorov <cryosay@gmail.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Diffstat (limited to 'drivers/tee')
| -rw-r--r-- | drivers/tee/sandbox.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c index 8ad7c09efdd..86b16a3bb8d 100644 --- a/drivers/tee/sandbox.c +++ b/drivers/tee/sandbox.c @@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params, uint slot; u64 val; char *value; - u32 value_sz; + u32 value_sz, tmp_sz; switch (func) { case TA_AVB_CMD_READ_ROLLBACK_INDEX: @@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params, if (!ep) return TEE_ERROR_ITEM_NOT_FOUND; - value_sz = strlen(ep->data) + 1; - memcpy(value, ep->data, value_sz); + tmp_sz = strlen(ep->data) + 1; + if (value_sz < tmp_sz) + return TEE_ERROR_SHORT_BUFFER; + + memcpy(value, ep->data, tmp_sz); + params[1].u.memref.size = tmp_sz; return TEE_SUCCESS; case TA_AVB_CMD_WRITE_PERSIST_VALUE: |