tee: sandbox: check for buffer size
Add additional check for buffer size when reading out persistent
storage value and provide back actual value size.
Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Oleksandr Suvorov <cryosay@gmail.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
index 8ad7c09..86b16a3 100644
--- a/drivers/tee/sandbox.c
+++ b/drivers/tee/sandbox.c
@@ -174,7 +174,7 @@
uint slot;
u64 val;
char *value;
- u32 value_sz;
+ u32 value_sz, tmp_sz;
switch (func) {
case TA_AVB_CMD_READ_ROLLBACK_INDEX:
@@ -267,8 +267,12 @@
if (!ep)
return TEE_ERROR_ITEM_NOT_FOUND;
- value_sz = strlen(ep->data) + 1;
- memcpy(value, ep->data, value_sz);
+ tmp_sz = strlen(ep->data) + 1;
+ if (value_sz < tmp_sz)
+ return TEE_ERROR_SHORT_BUFFER;
+
+ memcpy(value, ep->data, tmp_sz);
+ params[1].u.memref.size = tmp_sz;
return TEE_SUCCESS;
case TA_AVB_CMD_WRITE_PERSIST_VALUE: