]> git.baikalelectronics.ru Git - arm-tf.git/commit
fix(nxp-crypto): fix coverity issue
authorPankaj Gupta <pankaj.gupta@nxp.com>
Tue, 17 May 2022 17:07:16 +0000 (22:37 +0530)
committerJiafei Pan <Jiafei.Pan@nxp.com>
Wed, 23 Nov 2022 01:17:48 +0000 (09:17 +0800)
commite49229911f4e08e317453883886a113f3332b776
tree2981c66aa48baa569c9055e7bc3fd9decd08a73d
parent5199b3b93c6ada8dd830f625f77987d3474a6f98
fix(nxp-crypto): fix coverity issue

In function "desc_length", LSB byte of the first word of the
descriptor will be anded with 0x7F, to get the number of words
constructing the descriptor.

LSB byte of the first word of the descriptor is auto-incremented
with each add_word used while constructing the descriptor.

But if function "desc_add_word" is called more than
MAX_DESC_SIZE_WORDS times, then only the function "desc_length",
can return number of words greater than MAX_DESC_SIZE_WORDS.

This is the condition when core can overwrite the out of bound
memory.

Hence, the following fix is needed:
- Before adding any new word to the descriptor, a check for
  max word length needs to be added, into these functions:
  "desc_add_word" & "desc_add_ptr".

Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Signed-off-by: Jiafei Pan <Jiafei.Pan@nxp.com>
Change-Id: If896cd2e02ecde72fb09c5147119dec4f2f84bc3
drivers/nxp/crypto/caam/src/jobdesc.c