Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-11 07:24:46 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

tee: sandbox: check for buffer size

Browse source 
Add additional check for buffer size when reading out persistent
storage value and provide back actual value size.

Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Oleksandr Suvorov <cryosay@gmail.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Igor Opaniuk 2024-04-21 22:48:39 +02:00 • committed by Ilias Apalodimas
parent d097f9e129
commit 8800cbe9b8
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/tee/sandbox.c
View file

@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
uint slot;
u64 val;
char *value;
u32 value_sz;
u32 value_sz, tmp_sz;
switch (func) {
case TA_AVB_CMD_READ_ROLLBACK_INDEX:
@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
if (!ep)
return TEE_ERROR_ITEM_NOT_FOUND;
value_sz = strlen(ep->data) + 1;
memcpy(value, ep->data, value_sz);
tmp_sz = strlen(ep->data) + 1;
if (value_sz < tmp_sz)
return TEE_ERROR_SHORT_BUFFER;
memcpy(value, ep->data, tmp_sz);
params[1].u.memref.size = tmp_sz;
return TEE_SUCCESS;
case TA_AVB_CMD_WRITE_PERSIST_VALUE: