Skip to content

Commit 28f37e5

Browse files
ljd42danieldegrasse
authored andcommitted
drivers: crypto: crypto_ataes132a fix memset undefined behavior
Coverity reported a memory - illegal accesses when using memset in ataes132a_aes_ecb_block(). This can happen when the input block is exactly 16 bytes: memset(&param_buffer[19], 0x0, 0) is called. But this is an undefined behaviour in C even if size is 0, as &param_buffer[19] is an invalid pointer. The fix consists of simply skipping memset() in this case, since there's nothing to zero out. Coverity CID: 434642 Signed-off-by: Loic Domaigne <tech@domaigne.com>
1 parent 81f95f1 commit 28f37e5

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

drivers/crypto/crypto_ataes132a.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -634,7 +634,14 @@ int ataes132a_aes_ecb_block(const struct device *dev,
634634
param_buffer[1] = key_id;
635635
param_buffer[2] = 0x0;
636636
memcpy(param_buffer + 3, pkt->in_buf, buf_len);
637-
(void)memset(param_buffer + 3 + buf_len, 0x0, 16 - buf_len);
637+
/* skip memset() if buf_len==16.
638+
* Indeed, calling memset(&param_buffer[19], 0x0, 0)
639+
* is an undefined behaviour in C as &param_buffer[19] is
640+
* an invalid pointer (even if size is 0).
641+
*/
642+
if (buf_len < 16) {
643+
(void)memset(param_buffer + 3 + buf_len, 0x0, 16 - buf_len);
644+
}
638645

639646
return_code = ataes132a_send_command(dev, ATAES_LEGACY_OP, 0x00,
640647
param_buffer, buf_len + 3,

0 commit comments

Comments
 (0)