Re: [PATCH v1] tee: sandbox: check for buffer size

[Ilias Apalodimas]

On Sun, Apr 21, 2024 at 10:48:39PM +0200, Igor Opaniuk wrote:
> Add additional check for buffer size when reading out persistent
> storage value and provide back actual value size.
>
> Signed-off-by: Igor Opaniuk 
> ---
>
>  drivers/tee/sandbox.c | 10 +++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
> index 8ad7c09efdd..86b16a3bb8d 100644
> --- a/drivers/tee/sandbox.c
> +++ b/drivers/tee/sandbox.c
> @@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 
> func, uint num_params,
>   uint slot;
>   u64 val;
>   char *value;
> - u32 value_sz;
> + u32 value_sz, tmp_sz;
>
>   switch (func) {
>   case TA_AVB_CMD_READ_ROLLBACK_INDEX:
> @@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 
> func, uint num_params,
>   if (!ep)
>   return TEE_ERROR_ITEM_NOT_FOUND;
>
> - value_sz = strlen(ep->data) + 1;
> - memcpy(value, ep->data, value_sz);
> + tmp_sz = strlen(ep->data) + 1;
> + if (value_sz < tmp_sz)
> + return TEE_ERROR_SHORT_BUFFER;
> +
> + memcpy(value, ep->data, tmp_sz);
> + params[1].u.memref.size = tmp_sz;
>
>   return TEE_SUCCESS;
>   case TA_AVB_CMD_WRITE_PERSIST_VALUE:
> --
> 2.34.1
>

Reviewed-by: Ilias Apalodimas 

Re: [PATCH v1] tee: sandbox: check for buffer size

[Oleksandr Suvorov]

On Sun, Apr 21, 2024 at 11:48 PM Igor Opaniuk  wrote:
>
> Add additional check for buffer size when reading out persistent
> storage value and provide back actual value size.
>
> Signed-off-by: Igor Opaniuk 
Reviewed-by: Oleksandr Suvorov 

> ---
>
>  drivers/tee/sandbox.c | 10 +++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
> index 8ad7c09efdd..86b16a3bb8d 100644
> --- a/drivers/tee/sandbox.c
> +++ b/drivers/tee/sandbox.c
> @@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 
> func, uint num_params,
> uint slot;
> u64 val;
> char *value;
> -   u32 value_sz;
> +   u32 value_sz, tmp_sz;
>
> switch (func) {
> case TA_AVB_CMD_READ_ROLLBACK_INDEX:
> @@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 
> func, uint num_params,
> if (!ep)
> return TEE_ERROR_ITEM_NOT_FOUND;
>
> -   value_sz = strlen(ep->data) + 1;
> -   memcpy(value, ep->data, value_sz);
> +   tmp_sz = strlen(ep->data) + 1;
> +   if (value_sz < tmp_sz)
> +   return TEE_ERROR_SHORT_BUFFER;
> +
> +   memcpy(value, ep->data, tmp_sz);
> +   params[1].u.memref.size = tmp_sz;
>
> return TEE_SUCCESS;
> case TA_AVB_CMD_WRITE_PERSIST_VALUE:
> --
> 2.34.1
>


-- 
Best regards,

Oleksandr Suvorov
Software Engineer
T: +380 63 8489656
E: oleksandr.suvo...@foundries.io
W: www.foundries.io

[PATCH v1] tee: sandbox: check for buffer size

[Igor Opaniuk]

Add additional check for buffer size when reading out persistent
storage value and provide back actual value size.

Signed-off-by: Igor Opaniuk 
---

 drivers/tee/sandbox.c | 10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
index 8ad7c09efdd..86b16a3bb8d 100644
--- a/drivers/tee/sandbox.c
+++ b/drivers/tee/sandbox.c
@@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 
func, uint num_params,
uint slot;
u64 val;
char *value;
-   u32 value_sz;
+   u32 value_sz, tmp_sz;
 
switch (func) {
case TA_AVB_CMD_READ_ROLLBACK_INDEX:
@@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 
func, uint num_params,
if (!ep)
return TEE_ERROR_ITEM_NOT_FOUND;
 
-   value_sz = strlen(ep->data) + 1;
-   memcpy(value, ep->data, value_sz);
+   tmp_sz = strlen(ep->data) + 1;
+   if (value_sz < tmp_sz)
+   return TEE_ERROR_SHORT_BUFFER;
+
+   memcpy(value, ep->data, tmp_sz);
+   params[1].u.memref.size = tmp_sz;
 
return TEE_SUCCESS;
case TA_AVB_CMD_WRITE_PERSIST_VALUE:
-- 
2.34.1