Searched hist:ea81076f7896de7278dcd62b47b99d5dc3351caf (Results 1 – 1 of 1) sorted by relevance
| /optee_os/core/tee/ |
| H A D | tee_rpmb_fs.c | ea81076f7896de7278dcd62b47b99d5dc3351caf Wed Feb 06 10:04:31 UTC 2019 Jerome Forissier <jerome.forissier@linaro.org> core: RPMB FS: check for potential overflows
This commit deals with a number of potential integer overflows in the
RPMB FS code.
rpmb_fs_init() requests device information from the REE. The RPMB size
is returned in struct rpmb_dev_info (field rpmb_size_mult) and is used
in a multiplication that could overflow. Use MUL_OVERFLOW() to deal with
this case.
Some overflow checks are also added in the read and write paths.
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reported-by: Bastien Simondi <bsimondi@netflix.com> [2.12]
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
|