Skip to content
Permalink
Browse files

svc: check for allocation overflow in crypto calls part 2

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0011: "Integer overflow in crypto system calls (x2)"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
  • Loading branch information...
jbech-linaro authored and jforissier committed Sep 27, 2018
1 parent a637243 commit 70697bf3c5dc3d201341b01a1a8e5bc6d2fb48f8
Showing with 12 additions and 2 deletions.
  1. +12 −2 core/tee/tee_svc_cryp.c
@@ -3274,7 +3274,12 @@ TEE_Result syscall_asymm_operate(unsigned long state,
if (res != TEE_SUCCESS)
return res;

params = malloc(sizeof(TEE_Attribute) * num_params);
size_t alloc_size = 0;

if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
return TEE_ERROR_OVERFLOW;

params = malloc(alloc_size);
if (!params)
return TEE_ERROR_OUT_OF_MEMORY;
res = copy_in_attrs(utc, usr_params, num_params, params);
@@ -3436,7 +3441,12 @@ TEE_Result syscall_asymm_verify(unsigned long state,
if (res != TEE_SUCCESS)
return res;

params = malloc(sizeof(TEE_Attribute) * num_params);
size_t alloc_size = 0;

if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
return TEE_ERROR_OVERFLOW;

params = malloc(alloc_size);
if (!params)
return TEE_ERROR_OUT_OF_MEMORY;
res = copy_in_attrs(utc, usr_params, num_params, params);

0 comments on commit 70697bf

Please sign in to comment.
You can’t perform that action at this time.