Fixed CVE-2022-35858

Signed-off-by: Taras Drozdovskyi <[email protected]>
Samsung · Nov 24, 2022 · 3bc6085 · 3bc6085
1 parent 6ce511e
commit 3bc6085
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
@@ -14,7 +14,8 @@ We are releasing patches to eliminate vulnerabilities, you can see below:
 | 0.1.x-0.3.1 | N/A          |                    |                                                |
 | 0.4.0       | Fixed        |                    | CVE-2019-1010296                               |
 | 0.4.1       | Fixed        |                    | CVE-2022-36621, CVE-2022-36622, CVE-2022-38155,|
-|             |              |                    | CVE-2022-40762, CVE-2022-40759, CVE-2022-40761 |
+|             |              |                    | CVE-2022-40762, CVE-2022-40759, CVE-2022-40761,|
+|             |              |                    | CVE-2022-35858                                 |
 
 ---
 

diff --git a/tee/lib/libutee/tee_api_objects.c b/tee/lib/libutee/tee_api_objects.c
@@ -269,6 +269,11 @@ TEE_Result TEE_PopulateTransientObject(TEE_ObjectHandle object,
 {
 	TEE_Result res;
 	TEE_ObjectInfo info;
+
+	if (attrCount > 4) {
+		TEE_Panic(TEE_ERROR_BAD_PARAMETERS);
+		return TEE_ERROR_BAD_PARAMETERS;
+	}
 	struct utee_attribute ua[attrCount];
 
 	__utee_check_attr_in_annotation(attrs, attrCount);