From 74c92014c8fafccea9994bc62bc3c6a04143d4e9 Mon Sep 17 00:00:00 2001
From: Mattia Moffa <mattia@moffa.xyz>
Date: Fri, 29 May 2026 20:28:39 +0200
Subject: [PATCH] arm_tee_psa_ipc: validate NS pointers via
 cmse_check_address_range

Fixes F#4332, F#4336, F#4709
---
 src/arm_tee_psa_ipc.c | 44 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/src/arm_tee_psa_ipc.c b/src/arm_tee_psa_ipc.c
index d7f96246..e54b654f 100644
--- a/src/arm_tee_psa_ipc.c
+++ b/src/arm_tee_psa_ipc.c
@@ -28,6 +28,8 @@
 #include <psa/crypto.h>
 #include <psa/error.h>
 
+#include <arm_cmse.h>
+
 #include <wolfssl/wolfcrypt/memory.h>
 #include <wolfssl/wolfcrypt/types.h>
 #include <wolfboot/arm_tee_api.h>
@@ -756,6 +758,48 @@ int32_t arm_tee_psa_call(psa_handle_t handle, int32_t type,
 {
     (void)type;
 
+    if (in_len > 0 && in_vec == NULL) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+    if (in_len > 0 &&
+        cmse_check_address_range((void *)in_vec, in_len * sizeof(*in_vec),
+                                 CMSE_NONSECURE) == NULL) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+    if (out_len > 0 && out_vec == NULL) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+    if (out_len > 0 &&
+        cmse_check_address_range(out_vec, out_len * sizeof(*out_vec),
+                                 CMSE_NONSECURE) == NULL) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+    {
+        size_t i;
+        for (i = 0; i < in_len; i++) {
+            if (in_vec[i].len > 0 && in_vec[i].base == NULL) {
+                return PSA_ERROR_INVALID_ARGUMENT;
+            }
+            if (in_vec[i].len > 0 &&
+                cmse_check_address_range((void *)in_vec[i].base,
+                                         in_vec[i].len,
+                                         CMSE_NONSECURE) == NULL) {
+                return PSA_ERROR_INVALID_ARGUMENT;
+            }
+        }
+        for (i = 0; i < out_len; i++) {
+            if (out_vec[i].len > 0 && out_vec[i].base == NULL) {
+                return PSA_ERROR_INVALID_ARGUMENT;
+            }
+            if (out_vec[i].len > 0 &&
+                cmse_check_address_range(out_vec[i].base,
+                                         out_vec[i].len,
+                                         CMSE_NONSECURE) == NULL) {
+                return PSA_ERROR_INVALID_ARGUMENT;
+            }
+        }
+    }
+
     if (handle == (psa_handle_t)ARM_TEE_CRYPTO_HANDLE) {
         return wolfboot_crypto_dispatch(in_vec, in_len, out_vec, out_len);
     }