diff options
Diffstat (limited to 'core/tee/tee_svc_cryp.c')
| -rw-r--r-- | core/tee/tee_svc_cryp.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/core/tee/tee_svc_cryp.c b/core/tee/tee_svc_cryp.c index 7420ca86..b6012460 100644 --- a/core/tee/tee_svc_cryp.c +++ b/core/tee/tee_svc_cryp.c @@ -1332,11 +1332,14 @@ static TEE_Result copy_in_attrs(struct user_ta_ctx *utc, { TEE_Result res; uint32_t n; + size_t size = 0; + + if (MUL_OVERFLOW(sizeof(struct utee_attribute), attr_count, &size)) + return TEE_ERROR_OVERFLOW; res = tee_mmu_check_access_rights(utc, TEE_MEMORY_ACCESS_READ | TEE_MEMORY_ACCESS_ANY_OWNER, - (uaddr_t)usr_attrs, - attr_count * sizeof(struct utee_attribute)); + (uaddr_t)usr_attrs, size); if (res != TEE_SUCCESS) return res; |