commit 6b9702546653083100049bb97f81ae67898d1ce5
author Ryan Everett <ryan.everett@arm.com> Fri Jan 19 16:02:59 2024 +0000
committer Ryan Everett <ryan.everett@arm.com> Fri Feb 02 10:50:51 2024 +0000
tree fed654ec8e296f865abdf0b562f4e76fd1459395
parent 3e7ef37e07094eb478ee1ad3610d2b18a94e99a8

Protect buffer in psa_import_key

Signed-off-by: Ryan Everett <ryan.everett@arm.com>

library/psa_crypto.c

diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 106e174..2b09d8f 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -2063,11 +2063,12 @@
 }
 
 psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
-                            const uint8_t *data,
+                            const uint8_t *data_external,
                             size_t data_length,
                             mbedtls_svc_key_id_t *key)
 {
     psa_status_t status;
+    LOCAL_INPUT_DECLARE(data_external, data);
     psa_key_slot_t *slot = NULL;
     psa_se_drv_table_entry_t *driver = NULL;
     size_t bits;
@@ -2081,6 +2082,8 @@
         return PSA_ERROR_INVALID_ARGUMENT;
     }
 
+    LOCAL_INPUT_ALLOC(data_external, data_length, data);
+
     status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
                                     &slot, &driver);
     if (status != PSA_SUCCESS) {
@@ -2122,6 +2125,7 @@
 
     status = psa_finish_key_creation(slot, driver, key);
 exit:
+    LOCAL_INPUT_FREE(data_external, data);
     if (status != PSA_SUCCESS) {
         psa_fail_key_creation(slot, driver);
     }