Skip to content

Commit 4cc525a

Browse files
committed
fix(intel): fix fcs_client crashed when increased param size
No overflow buffer checking for param size. There is a security threat. Update code to check for param size according to cryto param mode. Signed-off-by: Jit Loon Lim <jit.loon.lim@intel.com>
1 parent 6c043b6 commit 4cc525a

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

plat/intel/soc/common/sip/socfpga_sip_fcs.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1637,12 +1637,10 @@ int intel_fcs_aes_crypt_init(uint32_t session_id, uint32_t context_id,
16371637
* Since crypto param size vary between mode.
16381638
* Check CBC/CTR here and limit to size 28 bytes
16391639
*/
1640-
else if ((((*param_addr_ptr & FCS_CRYPTO_BLOCK_MODE_MASK) == FCS_CRYPTO_CBC_MODE) ||
1640+
if ((((*param_addr_ptr & FCS_CRYPTO_BLOCK_MODE_MASK) == FCS_CRYPTO_CBC_MODE) ||
16411641
((*param_addr_ptr & FCS_CRYPTO_BLOCK_MODE_MASK) == FCS_CRYPTO_CTR_MODE)) &&
16421642
(param_size > FCS_CRYPTO_CBC_CTR_BUFFER_SIZE)) {
16431643
return INTEL_SIP_SMC_STATUS_REJECTED;
1644-
} else {
1645-
return INTEL_SIP_SMC_STATUS_REJECTED;
16461644
}
16471645

16481646
if (mbox_error == NULL) {

0 commit comments

Comments
 (0)