diff options
| author | Jens Wiklander <jens.wiklander@linaro.org> | 2018-06-07 10:08:51 +0200 |
|---|---|---|
| committer | Jérôme Forissier <jerome.forissier@linaro.org> | 2018-06-08 09:38:44 +0200 |
| commit | 09bce88385a991eabd857168cc1da3aaa0d52a66 (patch) | |
| tree | 924c77363e59008f753adb41a77d286e0413f17e /core/tee | |
| parent | 4c4e0dd02ba2232e802068635e86c4acf8232733 (diff) | |
core: fix syscall_cryp_obj_get_attr() with null buffer
Prior to this patch when syscall_cryp_obj_get_attr() is called with a
NULL buffer to query buffer size the function returns
TEE_ERROR_ACCESS_DENIED while TEE_ERROR_SHORT_BUFFER is expected. This
patch fixes syscall_cryp_obj_get_attr() to return TEE_ERROR_SHORT_BUFFER
if supplied buffer parameter is NULL.
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Diffstat (limited to 'core/tee')
| -rw-r--r-- | core/tee/tee_svc_cryp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/core/tee/tee_svc_cryp.c b/core/tee/tee_svc_cryp.c index e6b27567..54bafd60 100644 --- a/core/tee/tee_svc_cryp.c +++ b/core/tee/tee_svc_cryp.c @@ -553,7 +553,7 @@ static TEE_Result op_attr_secret_value_to_user(void *attr, if (res != TEE_SUCCESS) return res; - if (s < key->key_size) + if (s < key->key_size || !buffer) return TEE_ERROR_SHORT_BUFFER; return tee_svc_copy_to_user(buffer, key + 1, key->key_size); @@ -649,7 +649,7 @@ static TEE_Result op_attr_bignum_to_user(void *attr, return res; if (!req_size) return TEE_SUCCESS; - if (s < req_size) + if (s < req_size || !buffer) return TEE_ERROR_SHORT_BUFFER; /* Check we can access data using supplied user mode pointer */ @@ -758,7 +758,7 @@ static TEE_Result op_attr_value_to_user(void *attr, if (res != TEE_SUCCESS) return res; - if (s < req_size) + if (s < req_size || !buffer) return TEE_ERROR_SHORT_BUFFER; return tee_svc_copy_to_user(buffer, value, req_size); |