WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-3973: validate in_vec[N].len before dereferencing typed PS IPC pointers 

All four PS dispatch arms (PS_SET, PS_GET, PS_GET_INFO, PS_REMOVE) cast
in_vec[N].base to a typed pointer but only checked for NULL, not that
the caller-supplied .len covers the target type.  An NS caller could pass
len=0 (or len < sizeof) with a valid non-NULL base, causing the secure
side to read past the declared buffer.  Mirror the pattern already used
in wolfboot_crypto_dispatch (F-3541) and the attestation handler.
pull/795/head
Daniele Lacamera 2026-06-11 17:43:09 +02:00
parent e81f262b6c
commit 108a33cd54
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/arm_tee_psa_ipc.c
View File

@ -792,7 +792,8 @@ static int32_t arm_tee_psa_dispatch(psa_handle_t handle, int32_t type,
* in_vec[1].len after the bounds check would allow a TOCTOU
* double-fetch to grow the copy past WOLFBOOT_PS_MAX_DATA. */
data_len = in_vec[1].len;
if (uid == NULL || flags == NULL) {
if (uid == NULL || in_vec[0].len < sizeof(*uid) ||
flags == NULL || in_vec[2].len < sizeof(*flags)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (data_len > WOLFBOOT_PS_MAX_DATA) {
@ -827,7 +828,8 @@ static int32_t arm_tee_psa_dispatch(psa_handle_t handle, int32_t type,
}
uid = (const psa_storage_uid_t *)in_vec[0].base;
offset = (const rot_size_t *)in_vec[1].base;
if (uid == NULL || offset == NULL) {
if (uid == NULL || in_vec[0].len < sizeof(*uid) ||
offset == NULL || in_vec[1].len < sizeof(*offset)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
entry = wolfboot_ps_find(*uid);
@ -854,7 +856,7 @@ static int32_t arm_tee_psa_dispatch(psa_handle_t handle, int32_t type,
return PSA_ERROR_INVALID_ARGUMENT;
}
uid = (const psa_storage_uid_t *)in_vec[0].base;
if (uid == NULL) {
if (uid == NULL || in_vec[0].len < sizeof(*uid)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
entry = wolfboot_ps_find(*uid);
@ -881,7 +883,7 @@ static int32_t arm_tee_psa_dispatch(psa_handle_t handle, int32_t type,
return PSA_ERROR_INVALID_ARGUMENT;
}
uid = (const psa_storage_uid_t *)in_vec[0].base;
if (uid == NULL) {
if (uid == NULL || in_vec[0].len < sizeof(*uid)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
entry = wolfboot_ps_find(*uid);