From 108a33cd5426853e10aa338cd3b7a0fceb984f45 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Thu, 11 Jun 2026 17:43:09 +0200 Subject: [PATCH] F-3973: validate in_vec[N].len before dereferencing typed PS IPC pointers All four PS dispatch arms (PS_SET, PS_GET, PS_GET_INFO, PS_REMOVE) cast in_vec[N].base to a typed pointer but only checked for NULL, not that the caller-supplied .len covers the target type. An NS caller could pass len=0 (or len < sizeof) with a valid non-NULL base, causing the secure side to read past the declared buffer. Mirror the pattern already used in wolfboot_crypto_dispatch (F-3541) and the attestation handler. --- src/arm_tee_psa_ipc.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/arm_tee_psa_ipc.c b/src/arm_tee_psa_ipc.c index 422dc7a5..5e027fba 100644 --- a/src/arm_tee_psa_ipc.c +++ b/src/arm_tee_psa_ipc.c @@ -792,7 +792,8 @@ static int32_t arm_tee_psa_dispatch(psa_handle_t handle, int32_t type, * in_vec[1].len after the bounds check would allow a TOCTOU * double-fetch to grow the copy past WOLFBOOT_PS_MAX_DATA. */ data_len = in_vec[1].len; - if (uid == NULL || flags == NULL) { + if (uid == NULL || in_vec[0].len < sizeof(*uid) || + flags == NULL || in_vec[2].len < sizeof(*flags)) { return PSA_ERROR_INVALID_ARGUMENT; } if (data_len > WOLFBOOT_PS_MAX_DATA) { @@ -827,7 +828,8 @@ static int32_t arm_tee_psa_dispatch(psa_handle_t handle, int32_t type, } uid = (const psa_storage_uid_t *)in_vec[0].base; offset = (const rot_size_t *)in_vec[1].base; - if (uid == NULL || offset == NULL) { + if (uid == NULL || in_vec[0].len < sizeof(*uid) || + offset == NULL || in_vec[1].len < sizeof(*offset)) { return PSA_ERROR_INVALID_ARGUMENT; } entry = wolfboot_ps_find(*uid); @@ -854,7 +856,7 @@ static int32_t arm_tee_psa_dispatch(psa_handle_t handle, int32_t type, return PSA_ERROR_INVALID_ARGUMENT; } uid = (const psa_storage_uid_t *)in_vec[0].base; - if (uid == NULL) { + if (uid == NULL || in_vec[0].len < sizeof(*uid)) { return PSA_ERROR_INVALID_ARGUMENT; } entry = wolfboot_ps_find(*uid); @@ -881,7 +883,7 @@ static int32_t arm_tee_psa_dispatch(psa_handle_t handle, int32_t type, return PSA_ERROR_INVALID_ARGUMENT; } uid = (const psa_storage_uid_t *)in_vec[0].base; - if (uid == NULL) { + if (uid == NULL || in_vec[0].len < sizeof(*uid)) { return PSA_ERROR_INVALID_ARGUMENT; } entry = wolfboot_ps_find(*uid);