diff options
| -rw-r--r-- | MAINTAINERS | 9 | ||||
| -rw-r--r-- | drivers/tee/sandbox.c | 10 |
2 files changed, 16 insertions, 3 deletions
diff --git a/MAINTAINERS b/MAINTAINERS index d0a4a28b401..921ce05755a 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1640,9 +1640,18 @@ M: Jens Wiklander <jens.wiklander@linaro.org> M: Ilias Apalodimas <ilias.apalodimas@linaro.org> T: git https://source.denx.de/u-boot/custodians/u-boot-tpm.git S: Maintained +F: cmd/optee* +F: doc/README.tee +F: doc/device-tree-bindings/firmware/linaro,optee-tz.txt +F: drivers/firmware/scmi/optee_agent.c F: drivers/tee/ +F: include/sandboxtee.h F: include/tee.h F: include/tee/ +F: include/test/optee.h +F: test/dm/tee.c +F: test/optee/ +F: test/py/tests/test_optee_rpmb.py TEE-lib M: Bryan O'Donoghue <bryan.odonoghue@linaro.org> diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c index 8ad7c09efdd..86b16a3bb8d 100644 --- a/drivers/tee/sandbox.c +++ b/drivers/tee/sandbox.c @@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params, uint slot; u64 val; char *value; - u32 value_sz; + u32 value_sz, tmp_sz; switch (func) { case TA_AVB_CMD_READ_ROLLBACK_INDEX: @@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params, if (!ep) return TEE_ERROR_ITEM_NOT_FOUND; - value_sz = strlen(ep->data) + 1; - memcpy(value, ep->data, value_sz); + tmp_sz = strlen(ep->data) + 1; + if (value_sz < tmp_sz) + return TEE_ERROR_SHORT_BUFFER; + + memcpy(value, ep->data, tmp_sz); + params[1].u.memref.size = tmp_sz; return TEE_SUCCESS; case TA_AVB_CMD_WRITE_PERSIST_VALUE: |