[PATCH v1] tee: sandbox: check for buffer size

[Igor Opaniuk]

Add additional check for buffer size when reading out persistent
storage value and provide back actual value size.

Signed-off-by: Igor Opaniuk <igor.opan...@gmail.com>
---

 drivers/tee/sandbox.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
index 8ad7c09efdd..86b16a3bb8d 100644
--- a/drivers/tee/sandbox.c
+++ b/drivers/tee/sandbox.c
@@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 
func, uint num_params,
        uint slot;
        u64 val;
        char *value;
-       u32 value_sz;
+       u32 value_sz, tmp_sz;
 
        switch (func) {
        case TA_AVB_CMD_READ_ROLLBACK_INDEX:
@@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 
func, uint num_params,
                if (!ep)
                        return TEE_ERROR_ITEM_NOT_FOUND;
 
-               value_sz = strlen(ep->data) + 1;
-               memcpy(value, ep->data, value_sz);
+               tmp_sz = strlen(ep->data) + 1;
+               if (value_sz < tmp_sz)
+                       return TEE_ERROR_SHORT_BUFFER;
+
+               memcpy(value, ep->data, tmp_sz);
+               params[1].u.memref.size = tmp_sz;
 
                return TEE_SUCCESS;
        case TA_AVB_CMD_WRITE_PERSIST_VALUE:
-- 
2.34.1