Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-04-19 02:54:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(tsp): loop / crash if mmap of region fails

Browse source 
In test_memory_send the variable i is of unsigned type, so
it is never negative. If i is 0, the result of i-- is
4294967295. Don't know what happens if trying to
access composite->address_range_array[4294967295].
Made i a signed integer.

Signed-off-by: Thomas Viehweger <Thomas.Viehweger@rohde-schwarz.com>
Change-Id: I8b4e532749b5e86e4b5acd238e72c3f88e309ff2
This commit is contained in:
Thomas Viehweger 2023-01-23 11:26:37 +01:00
parent 344e5e8149
commit 8c353e0058
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
bl32/tsp/tsp_ffa_main.c
View file

@ -201,7 +201,7 @@ static int test_memory_send(ffa_endpoint_id16_t sender, uint64_t handle,
/* Only expecting to be sent memory from NWd so map accordingly. */
mem_attrs |= MT_NS;
for (uint32_t i = 0U; i < composite->address_range_count; i++) {
for (int32_t i = 0; i < (int32_t)composite->address_range_count; i++) {
size_t size = composite->address_range_array[i].page_count * PAGE_SIZE;
ptr = (char *) composite->address_range_array[i].address;
@ -211,7 +211,7 @@ static int test_memory_send(ffa_endpoint_id16_t sender, uint64_t handle,
size, mem_attrs);
if (ret != 0) {
ERROR("Failed [%u] mmap_add_dynamic_region %u (%lx) (%lx) (%x)!\n",
ERROR("Failed [%d] mmap_add_dynamic_region %u (%lx) (%lx) (%x)!\n",
i, ret,
(uint64_t)composite->address_range_array[i].address,
size, mem_attrs);