[PATCH v1] tee: sandbox: check for buffer size

[Oleksandr Suvorov]

On Sun, Apr 21, 2024 at 11:48 PM Igor Opaniuk <igor.opaniuk at gmail.com> wrote:
>
> Add additional check for buffer size when reading out persistent
> storage value and provide back actual value size.
>
> Signed-off-by: Igor Opaniuk <igor.opaniuk at gmail.com>
Reviewed-by: Oleksandr Suvorov <cryosay at gmail.com>

> ---
>
>  drivers/tee/sandbox.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
> index 8ad7c09efdd..86b16a3bb8d 100644
> --- a/drivers/tee/sandbox.c
> +++ b/drivers/tee/sandbox.c
> @@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
>         uint slot;
>         u64 val;
>         char *value;
> -       u32 value_sz;
> +       u32 value_sz, tmp_sz;
>
>         switch (func) {
>         case TA_AVB_CMD_READ_ROLLBACK_INDEX:
> @@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
>                 if (!ep)
>                         return TEE_ERROR_ITEM_NOT_FOUND;
>
> -               value_sz = strlen(ep->data) + 1;
> -               memcpy(value, ep->data, value_sz);
> +               tmp_sz = strlen(ep->data) + 1;
> +               if (value_sz < tmp_sz)
> +                       return TEE_ERROR_SHORT_BUFFER;
> +
> +               memcpy(value, ep->data, tmp_sz);
> +               params[1].u.memref.size = tmp_sz;
>
>                 return TEE_SUCCESS;
>         case TA_AVB_CMD_WRITE_PERSIST_VALUE:
> --
> 2.34.1
>


-- 
Best regards,

Oleksandr Suvorov
Software Engineer
T: +380 63 8489656
E: oleksandr.suvorov at foundries.io
W: www.foundries.io