github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2025-09-13 04:50:07 +00:00
Code Issues Projects Releases Wiki Activity

DM: Fix potential buffer overflow and uninitialized variable

Browse Source 
- @'rpmb_check_frame()', avoid buffer overflow access
    when calling 'memcmp()'

Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
This commit is contained in:
Yonghua Huang
2018-07-12 18:07:00 +08:00
committed by Jack Ren
parent 194fd8ba1e
commit 83361018b5
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
devicemodel/hw/platform/rpmb/rpmb_backend.c
View File

@@ -180,6 +180,7 @@ static int rpmb_check_frame(const char *cmd_str, int *err,
{
uint32_t i;
uint8_t mac[32];
size_t len;
for (i = 0; i < frame_cnt; i++) {
if (write_counter && *write_counter != swap32(frames[i].write_counter)) {
@@ -203,7 +204,11 @@ static int rpmb_check_frame(const char *cmd_str, int *err,
return -1;
}
if (addr && !memcmp(cmd_str, WRITE_DATA_STR, sizeof(WRITE_DATA_STR))) {
len = strlen(cmd_str) + 1;
if (len > sizeof(WRITE_DATA_STR))
len = sizeof(WRITE_DATA_STR);
if (addr && !memcmp(cmd_str, WRITE_DATA_STR, len)) {
if (*addr < get_common_blocks()) {
*err = RPMB_RES_WRITE_FAILURE;
DPRINTF(("%s: Common block is read only\n", cmd_str));