Crypto: Prevent the scratch allocator from overflowing
If the requested_size from the scratch allocator is
greater than 0xfffffffc, the align macro overflows
without failing allocation thus allowing out-of-bounds
writes in the Crypto partition memory.
Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com>
Change-Id: Ic218fea8238ecd3e8d146586d2c413386870d580
diff --git a/secure_fw/partitions/crypto/crypto_init.c b/secure_fw/partitions/crypto/crypto_init.c
index e6557c8..185bd57 100644
--- a/secure_fw/partitions/crypto/crypto_init.c
+++ b/secure_fw/partitions/crypto/crypto_init.c
@@ -112,6 +112,11 @@
static psa_status_t tfm_crypto_alloc_scratch(size_t requested_size, void **buf)
{
+ /* Prevent ALIGN() from overflowing */
+ if (requested_size > SIZE_MAX - (TFM_CRYPTO_IOVEC_ALIGNMENT - 1)) {
+ return PSA_ERROR_INSUFFICIENT_MEMORY;
+ }
+
/* Ensure alloc_index remains aligned to the required iovec alignment */
requested_size = ALIGN(requested_size, TFM_CRYPTO_IOVEC_ALIGNMENT);