From 426a5457d702031df1b0f7947bc7ef85cb03b18c Mon Sep 17 00:00:00 2001 From: Tomasz Chyrowicz Date: Mon, 18 Nov 2024 15:20:11 +0100 Subject: [PATCH] ssf: Sanitize returned digest pointer Handle cases, in which SDFW responds with NULL as manifest digest value. Ref: NCSDK-NONE Signed-off-by: Tomasz Chyrowicz --- .../services/suit_service/suit_update.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/subsys/sdfw_services/services/suit_service/suit_update.c b/subsys/sdfw_services/services/suit_service/suit_update.c index bd4195e1a062..6eda595d80e7 100644 --- a/subsys/sdfw_services/services/suit_service/suit_update.c +++ b/subsys/sdfw_services/services/suit_service/suit_update.c @@ -185,16 +185,22 @@ suit_ssf_err_t suit_get_installed_manifest_info(suit_manifest_class_id_t *manife if ((alg_id != NULL) && (digest != NULL)) { const size_t manifest_digest_len = rsp_data->SSF_SUIT_RSP_ARG(get_installed_manifest_info, digest).len; + const uint8_t *manifest_digest = + rsp_data->SSF_SUIT_RSP_ARG(get_installed_manifest_info, digest).value; + if (manifest_digest_len > digest->size) { ssf_client_decode_done(rsp_pkt); return SUIT_PLAT_ERR_NOMEM; } *alg_id = rsp_data->SSF_SUIT_RSP_ARG(get_installed_manifest_info, alg_id); - memcpy((uint8_t *)digest->mem, - rsp_data->SSF_SUIT_RSP_ARG(get_installed_manifest_info, digest).value, - manifest_digest_len); - digest->size = manifest_digest_len; + if (manifest_digest != NULL) { + memcpy((uint8_t *)digest->mem, manifest_digest, manifest_digest_len); + digest->size = manifest_digest_len; + } else { + digest->mem = NULL; + digest->size = 0; + } } ssf_client_decode_done(rsp_pkt);