Re: [PATCH v1] tee: sandbox: check for buffer size

On Sun, Apr 21, 2024 at 11:48 PM Igor Opaniuk igor.opaniuk@gmail.com wrote:

Add additional check for buffer size when reading out persistent storage value and provide back actual value size.

Signed-off-by: Igor Opaniuk igor.opaniuk@gmail.com

Reviewed-by: Oleksandr Suvorov cryosay@gmail.com

---

drivers/tee/sandbox.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c index 8ad7c09efdd..86b16a3bb8d 100644 --- a/drivers/tee/sandbox.c +++ b/drivers/tee/sandbox.c @@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params, uint slot; u64 val; char *value;

•   u32 value_sz;
  

•   u32 value_sz, tmp_sz;
  
    switch (func) {
    case TA_AVB_CMD_READ_ROLLBACK_INDEX:
  

@@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params, if (!ep) return TEE_ERROR_ITEM_NOT_FOUND;

•           value_sz = strlen(ep->data) + 1;
  

•           memcpy(value, ep->data, value_sz);
  

•           tmp_sz = strlen(ep->data) + 1;
  

•           if (value_sz < tmp_sz)
  

•                   return TEE_ERROR_SHORT_BUFFER;
  

•           memcpy(value, ep->data, tmp_sz);
  

•           params[1].u.memref.size = tmp_sz;
  
            return TEE_SUCCESS;
    case TA_AVB_CMD_WRITE_PERSIST_VALUE:
  

-- 2.34.1