commit 8512b5693bf70afa1c7fe715a650659b0c33d842
author Antonio de Angelis <antonio.deangelis@arm.com> Fri Jan 03 21:51:01 2025 +0000
committer Antonio de Angelis <Antonio.deAngelis@arm.com> Mon Jan 06 16:14:30 2025 +0200
tree b665449c42123f0daf8b2af458ad4910b4db0147
parent 9076ca615da4d8249fb6f1839b1b2c7027be8457

DPE: Use a 64-bit buffer in call to QCBOR API to retrieve cert_id

The QCBOR API retrieves the cert_id using a pointer to a 64-bit
value, hence passing directly a pointer to a 32-bit cert_id
might break the API. Convert to a 32-bit value just before the
call to the derive_context() function.

Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com>
Change-Id: I49575900beb966cc8014f9dcb47872eb17034b43

partitions/dice_protection_environment/dpe_cmd_decode.c

diff --git a/partitions/dice_protection_environment/dpe_cmd_decode.c b/partitions/dice_protection_environment/dpe_cmd_decode.c
index fef4588..f941be8 100644
--- a/partitions/dice_protection_environment/dpe_cmd_decode.c
+++ b/partitions/dice_protection_environment/dpe_cmd_decode.c
@@ -215,6 +215,7 @@
     uint8_t *new_certificate_buf = ALLOC_TEMP_BUF;
     uint8_t exported_cdi_buf[DICE_MAX_ENCODED_CDI_SIZE];
     uint32_t cert_id;
+    uint64_t cert_id64;
     size_t new_certificate_actual_size = 0;
     size_t exported_cdi_actual_size = 0;
     QCBORItem item;
@@ -252,7 +253,7 @@
     memcpy(&context_handle, out.ptr, out.len);
     COUNT_ARGS(num_of_valid_arguments);
 
-    QCBORDecode_GetUInt64InMapN(decode_ctx, DPE_DERIVE_CONTEXT_CERT_ID, &cert_id);
+    QCBORDecode_GetUInt64InMapN(decode_ctx, DPE_DERIVE_CONTEXT_CERT_ID, &cert_id64);
     /* Check if cert_id was encoded in the received command buffer */
     CHECK_AND_COUNT_OPTIONAL_ARGUMENT(decode_ctx);
 
@@ -313,6 +314,13 @@
         return DPE_INVALID_ARGUMENT;
     }
 
+    /* The QCBOR function uses a 64-bit pointer, but the context info is on 32 bit */
+    if (cert_id64 > UINT32_MAX) {
+        return DPE_INVALID_ARGUMENT;
+    }
+
+    cert_id = (uint32_t)cert_id64;
+
     dpe_err = derive_context_request(context_handle, cert_id, retain_parent_context,
                                      allow_new_context_to_derive, create_certificate,
                                      &dice_inputs, client_id,