Skip to content

Commit

Permalink
regression_4006: fix fuzzing shared memory content
Browse files Browse the repository at this point in the history
Explicit uses the stack to refer to attribute TEE_ATTR_RSA_OAEP_MGF_HASH
passed to the crypt TA in tests regression 4006.37 and 4006.38 as
the current implementation makes to TA to see an uninitialized buffer
reference.

Link: OP-TEE/optee_os#6143
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
  • Loading branch information
etienne-lms authored and jforissier committed Jun 28, 2023
1 parent 232dfd2 commit a286b57
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions host/xtest/regression_4000.c
Original file line number Diff line number Diff line change
Expand Up @@ -3832,6 +3832,7 @@ static void xtest_tee_test_4006(ADBG_Case_t *c)
uint32_t pub_key_type = 0;
uint32_t priv_key_type = 0;
uint32_t hash_algo = 0;
uint32_t sha1_algo_id = TEE_ALG_SHA1;

if (!ADBG_EXPECT_TEEC_SUCCESS(c,
xtest_teec_open_session(&session, &crypt_user_ta_uuid, NULL,
Expand Down Expand Up @@ -4132,9 +4133,9 @@ static void xtest_tee_test_4006(ADBG_Case_t *c)
algo_params[0].attributeID =
TEE_ATTR_RSA_OAEP_MGF_HASH;
algo_params[0].content.ref.length =
sizeof(uint32_t);
sizeof(sha1_algo_id);
algo_params[0].content.ref.buffer =
&(uint32_t){TEE_ALG_SHA1};
&sha1_algo_id;
num_algo_params = 1;
}

Expand Down

0 comments on commit a286b57

Please sign in to comment.