Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_security): Add more validation checks

Browse Source
This commit is contained in:
harshal.patil
2026-02-28 11:02:13 +05:30
committed by Mahavir Jain
parent 0db717b9ec
commit 398d9ea9cd
3 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
components/esp_security/include/esp_ds.h
View File

@@ -27,6 +27,7 @@ extern "C" {
#define ESP_DS_SIGNATURE_M_PRIME_BIT_LEN 32
#define ESP_DS_SIGNATURE_L_BIT_LEN 32
#define ESP_DS_SIGNATURE_PADDING_BIT_LEN 64
#define ESP_DS_DATA_KEY_SIZE 32
/* Length of parameter 'C' stored in flash, in bytes
- Operands Y, M and r_bar; each equal to maximum RSA bit length

5
components/esp_security/src/esp_key_mgr.c
View File

@@ -561,6 +561,11 @@ esp_err_t esp_key_mgr_activate_key(esp_key_mgr_key_recovery_info_t *key_recovery
return ESP_ERR_INVALID_ARG;
}
if (key_recovery_info->magic != KEY_HUK_SECTOR_MAGIC) {
ESP_LOGE(TAG, "Invalid key recovery info magic");
return ESP_ERR_INVALID_ARG;
}
esp_key_mgr_key_type_t key_type = key_recovery_info->key_type;
ESP_LOGD(TAG, "Activating key of type %d", key_type);

4
components/esp_tee/subproject/main/core/esp_secure_services.c
View File

@@ -347,6 +347,8 @@ esp_err_t _ss_esp_ds_encrypt_params(esp_ds_data_t *data,
(esp_tee_ptr_in_ree((void *)iv) && esp_tee_ptr_in_ree((void *)key)));
valid_addr &= esp_tee_ptr_in_ree((void *)((char *)data + sizeof(esp_ds_data_t)));
valid_addr &= esp_tee_ptr_in_ree((void *)((char *)p_data + sizeof(esp_ds_p_data_t)));
valid_addr &= esp_tee_ptr_in_ree((void *)((char *)key + ESP_DS_DATA_KEY_SIZE));
if (!valid_addr) {
return ESP_ERR_INVALID_ARG;
@@ -366,6 +368,8 @@ esp_err_t _ss_esp_ds_encrypt_params_using_key_type(esp_ds_data_t *data,
(esp_tee_ptr_in_ree((void *)iv) && esp_tee_ptr_in_ree((void *)key)));
valid_addr &= esp_tee_ptr_in_ree((void *)((char *)data + sizeof(esp_ds_data_t)));
valid_addr &= esp_tee_ptr_in_ree((void *)((char *)p_data + sizeof(esp_ds_p_data_t)));
valid_addr &= esp_tee_ptr_in_ree((void *)((char *)key + ESP_DS_DATA_KEY_SIZE));
if (!valid_addr) {
return ESP_ERR_INVALID_ARG;