From 44e3c92a62908cba45995534938ad7adfb523a69 Mon Sep 17 00:00:00 2001 From: Brian Quach Date: Wed, 6 Dec 2023 10:00:15 -0600 Subject: [PATCH] SPM: Fix NULL pointer dereference when passing no outvecs to psa_call. If a psa_call is made with outvecs followed by a psa_call without outvecs, a NULL pointer dereference will occur in update_caller_outvec_len. Signed-off-by: Brian Quach Change-Id: a801a13748fcfa84d2614934f91f111c746c5954 --- secure_fw/spm/core/psa_call_api.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/secure_fw/spm/core/psa_call_api.c b/secure_fw/spm/core/psa_call_api.c index 6e2eca8c7..ed4cc4233 100644 --- a/secure_fw/spm/core/psa_call_api.c +++ b/secure_fw/spm/core/psa_call_api.c @@ -129,6 +129,8 @@ psa_status_t spm_associate_call_params(struct connection_t *p_connection, ns_access = 0; } + spm_memset(p_connection->msg.out_size, 0, sizeof(p_connection->msg.out_size)); + /* * For client output vector, it is a PROGRAMMER ERROR if the provided * payload memory reference was invalid or not read-write. -- 2.42.0.windows.2