diff options
| author | Marc Bonnici <marc.bonnici@arm.com> | 2022-10-18 18:01:44 +0100 |
|---|---|---|
| committer | Shruti Gupta <shruti.gupta@arm.com> | 2022-12-08 12:29:58 +0000 |
| commit | def7590b3e34ff69b297c239cb8948d0bdc9c691 (patch) | |
| tree | df02c282b211a438c41f90c1f2da9dfd66e0b9d8 /services/std_svc | |
| parent | 825641d6150f05c1bcf6328ec726f46f2e9e37f9 (diff) | |
| download | arm-trusted-firmware-def7590b3e34ff69b297c239cb8948d0bdc9c691.tar.gz | |
fix(el3-spmc): improve bound check for descriptor
Ensure that there is sufficient space in the memory
descriptor to accommodate the size of the composite memory
struct as part of the descriptor.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: Iea646b144c59a2a1a171298cabb5f31040a8af31
Diffstat (limited to 'services/std_svc')
| -rw-r--r-- | services/std_svc/spm/el3_spmc/spmc_shared_mem.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/services/std_svc/spm/el3_spmc/spmc_shared_mem.c b/services/std_svc/spm/el3_spmc/spmc_shared_mem.c index 89d7b3177..bf3fb280f 100644 --- a/services/std_svc/spm/el3_spmc/spmc_shared_mem.c +++ b/services/std_svc/spm/el3_spmc/spmc_shared_mem.c @@ -385,7 +385,8 @@ spmc_shm_get_v1_1_descriptor_size(struct ffa_mtd_v1_0 *orig, size_t desc_size) emad_array[0].comp_mrd_offset); /* Check the calculated address is within the memory descriptor. */ - if ((uintptr_t) mrd >= (uintptr_t)((uint8_t *) orig + desc_size)) { + if (((uintptr_t) mrd + sizeof(struct ffa_comp_mrd)) > + (uintptr_t)((uint8_t *) orig + desc_size)) { return 0; } size += mrd->address_range_count * sizeof(struct ffa_cons_mrd); @@ -424,7 +425,8 @@ spmc_shm_get_v1_0_descriptor_size(struct ffa_mtd *orig, size_t desc_size) emad_array[0].comp_mrd_offset); /* Check the calculated address is within the memory descriptor. */ - if ((uintptr_t) mrd >= (uintptr_t)((uint8_t *) orig + desc_size)) { + if (((uintptr_t) mrd + sizeof(struct ffa_comp_mrd)) > + (uintptr_t)((uint8_t *) orig + desc_size)) { return 0; } size += mrd->address_range_count * sizeof(struct ffa_cons_mrd); |