WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

arm_tee_psa_ipc: validate NS pointers via cmse_check_address_range 

Fixes F#4332, F#4336, F#4709
pull/794/head
Mattia Moffa 2026-05-29 20:28:39 +02:00 committed by Daniele Lacamera
parent b60bd311a3
commit 74c92014c8
1 changed files with 44 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
src/arm_tee_psa_ipc.c
View File

@ -28,6 +28,8 @@
#include <psa/crypto.h>
#include <psa/error.h>
#include <arm_cmse.h>
#include <wolfssl/wolfcrypt/memory.h>
#include <wolfssl/wolfcrypt/types.h>
#include <wolfboot/arm_tee_api.h>
@ -756,6 +758,48 @@ int32_t arm_tee_psa_call(psa_handle_t handle, int32_t type,
{
(void)type;
if (in_len > 0 && in_vec == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (in_len > 0 &&
cmse_check_address_range((void *)in_vec, in_len * sizeof(*in_vec),
CMSE_NONSECURE) == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (out_len > 0 && out_vec == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (out_len > 0 &&
cmse_check_address_range(out_vec, out_len * sizeof(*out_vec),
CMSE_NONSECURE) == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
{
size_t i;
for (i = 0; i < in_len; i++) {
if (in_vec[i].len > 0 && in_vec[i].base == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (in_vec[i].len > 0 &&
cmse_check_address_range((void *)in_vec[i].base,
in_vec[i].len,
CMSE_NONSECURE) == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
}
for (i = 0; i < out_len; i++) {
if (out_vec[i].len > 0 && out_vec[i].base == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (out_vec[i].len > 0 &&
cmse_check_address_range(out_vec[i].base,
out_vec[i].len,
CMSE_NONSECURE) == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
}
}
if (handle == (psa_handle_t)ARM_TEE_CRYPTO_HANDLE) {
return wolfboot_crypto_dispatch(in_vec, in_len, out_vec, out_len);
}