commit f028fe195ba8ea50e3835b718540295aa5392e5c
author Ryan Everett <ryan.everett@arm.com> Mon Jan 08 17:14:44 2024 +0000
committer Ryan Everett <ryan.everett@arm.com> Fri Feb 02 10:33:09 2024 +0000
tree 837e0429fe7cd84b8affd2ace6144b7086181502
parent 8a35fd58eefd202e2ae396e02d9a1a0b0380b019

Protect buffer in psa_import_key

Signed-off-by: Ryan Everett <ryan.everett@arm.com>

library/psa_crypto.c

diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index d21c13e..cc7dc09 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -2199,11 +2199,12 @@
 }
 
 psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
-                            const uint8_t *data,
+                            const uint8_t *data_external,
                             size_t data_length,
                             mbedtls_svc_key_id_t *key)
 {
     psa_status_t status;
+    LOCAL_INPUT_DECLARE(data_external, data);
     psa_key_slot_t *slot = NULL;
     psa_se_drv_table_entry_t *driver = NULL;
     size_t bits;
@@ -2223,6 +2224,8 @@
         return PSA_ERROR_NOT_SUPPORTED;
     }
 
+    LOCAL_INPUT_ALLOC(data_external, data_length, data);
+
     status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
                                     &slot, &driver);
     if (status != PSA_SUCCESS) {
@@ -2277,6 +2280,7 @@
 
     status = psa_finish_key_creation(slot, driver, key);
 exit:
+    LOCAL_INPUT_FREE(data_external, data);
     if (status != PSA_SUCCESS) {
         psa_fail_key_creation(slot, driver);
     }