Skip to content

framework: Add fwk_str_is_in_boundry function

Matthew Wellings requested to merge mw/transport-bounds-fix into main

This change fixes a recently identified integer overflow issue with the bound check expression ((offset + size) > channel_ctx->max_payload_size) which under the condition ((size + offset) > SIZE_MAX) could potentially be exploited to write to the buffer with a larger but invalid length (size), or a large but invalid offset.

The change adds a new fwk_str_is_in_boundry function which uses a re-arranged expression to avoid this integer overflow.

Also adds associated unit tests.

NOTE: At present there is no known code path in the firmware that leads to this situation.

Signed-off-by: Matthew Wellings matthew.wellings@arm.com

Merge request reports