From: Igor Opaniuk <igor.opaniuk@gmail.com>
Date: Sun, 21 Apr 2024 20:48:39 +0000 (+0200)
Subject: tee: sandbox: check for buffer size
X-Git-Url: http://git.dujemihanovic.xyz/?a=commitdiff_plain;h=8800cbe9b83bf15ca6dc43ca4b05269b3126526a;p=u-boot.git

tee: sandbox: check for buffer size

Add additional check for buffer size when reading out persistent
storage value and provide back actual value size.

Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Oleksandr Suvorov <cryosay@gmail.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
---

diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
index 8ad7c09efd..86b16a3bb8 100644
--- a/drivers/tee/sandbox.c
+++ b/drivers/tee/sandbox.c
@@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
 	uint slot;
 	u64 val;
 	char *value;
-	u32 value_sz;
+	u32 value_sz, tmp_sz;
 
 	switch (func) {
 	case TA_AVB_CMD_READ_ROLLBACK_INDEX:
@@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
 		if (!ep)
 			return TEE_ERROR_ITEM_NOT_FOUND;
 
-		value_sz = strlen(ep->data) + 1;
-		memcpy(value, ep->data, value_sz);
+		tmp_sz = strlen(ep->data) + 1;
+		if (value_sz < tmp_sz)
+			return TEE_ERROR_SHORT_BUFFER;
+
+		memcpy(value, ep->data, tmp_sz);
+		params[1].u.memref.size = tmp_sz;
 
 		return TEE_SUCCESS;
 	case TA_AVB_CMD_WRITE_PERSIST_VALUE: