Make sure we are not freeing NULL operation handle 56/212256/6 accepted/tizen/unified/20190830.052635 submit/tizen/20190827.083251
authorArkadiusz Bokowy <a.bokowy@partner.samsung.com>
Fri, 16 Aug 2019 09:05:52 +0000 (11:05 +0200)
committerTomasz Swierczek <t.swierczek@samsung.com>
Tue, 27 Aug 2019 04:51:20 +0000 (04:51 +0000)
According to the GP Internal API <= 1.1.2, freeing an invalid operation
handle should result in panic.

For GP Internal API >= 1.2 user can pass TEE_HANDLE_NULL to TEE_FreeOperation().

Signed-off-by: Tomasz Swierczek <t.swierczek@samsung.com>
Change-Id: I6067c70e4fdc1f5ed658b35d6e8bdce90e107af5

ta/src/cmd_exec.c
ta/src/crypto_derive.c
ta/src/crypto_symmetric.c
ta/src/internal.c

index 647071b2313ce7878d7533210ed98d182365bcc5..52ada4a3d8d43eae43d5ab7eed1162375f500209 100644 (file)
@@ -447,7 +447,8 @@ static TEE_Result KM_InputDataDigest(uint32_t hash,
 clean:
        if (ret != TEE_SUCCESS)
                free(tmpDigest);
-       TEE_FreeOperation(digestOperation);
+       if (digestOperation != TEE_HANDLE_NULL)
+               TEE_FreeOperation(digestOperation);
        return ret;
 }
 
@@ -784,7 +785,8 @@ clean:
        free(in_padded);
        free(out);
        TEE_CloseObject(key);
-       if (operation != TEE_HANDLE_NULL) TEE_FreeOperation(operation);
+       if (operation != TEE_HANDLE_NULL)
+               TEE_FreeOperation(operation);
        return ret;
 }
 
@@ -953,7 +955,8 @@ clean:
        free(out);
        free(out_tag);
        TEE_CloseObject(key);
-       TEE_FreeOperation(op);
+       if (op != TEE_HANDLE_NULL)
+               TEE_FreeOperation(op);
        return ret;
 }
 
@@ -1057,7 +1060,8 @@ TEE_Result KM_ExecCmdAsymmetric(uint32_t commandID, TEE_Param param[4])
 
 clean:
        TEE_CloseObject(key);
-       TEE_FreeOperation(operation);
+       if (operation != TEE_HANDLE_NULL)
+               TEE_FreeOperation(operation);
        free(out);
        return ret;
 }
@@ -1162,7 +1166,8 @@ clean:
        TEE_CloseObject(key);
        free(out);
        free(digest);
-       TEE_FreeOperation(operation);
+       if (operation != TEE_HANDLE_NULL)
+               TEE_FreeOperation(operation);
        return ret;
 }
 
@@ -1248,7 +1253,8 @@ TEE_Result KM_ExecCmdVerify(TEE_Param param[4])
 clean:
        TEE_CloseObject(key);
        free(digest);
-       TEE_FreeOperation(operation);
+       if (operation != TEE_HANDLE_NULL)
+               TEE_FreeOperation(operation);
        return ret;
 }
 
index 64bb8ddd394ab1ea949291f28a13a7b36f3db27e..75db9d545b1adf8b5b7ddd2cef38840fee18a63e 100644 (file)
@@ -195,7 +195,8 @@ TEE_Result KM_DeriveKey(void *pwd, uint32_t pwd_size, void *salt, uint32_t salt_
        *out_key = keyHandle;
 
 end:
-       if (hmacOp != TEE_HANDLE_NULL) TEE_FreeOperation(hmacOp);
+       if (hmacOp != TEE_HANDLE_NULL)
+               TEE_FreeOperation(hmacOp);
        free(hmacKeyBuffer);
        free(hmacInBuffer);
        free(blockBuffer);
index 4a2a9e3f0ef36b9475b983fe3df0cdf99b81e57c..76f0bf219941164166f1866b3054e2fd1faabf8e 100644 (file)
@@ -97,7 +97,8 @@ TEE_Result KM_SymmetricCrypt_AES_CFB(TEE_ObjectHandle key, uint32_t mode,
        }
 
 clean:
-       if (op != TEE_HANDLE_NULL) TEE_FreeOperation(op);
+       if (op != TEE_HANDLE_NULL)
+               TEE_FreeOperation(op);
        return ret;
 }
 
index 732337105bc9e9b7b2d31d62eec48c0ef333b11e..89ea811b84662867b9c26daec491a54d7d59e195 100644 (file)
@@ -206,7 +206,8 @@ TEE_Result KM_EncryptDataWithPwd(const KM_PwdData *pwd, void *in, size_t in_size
        }
 
 out:
-       if (op != TEE_HANDLE_NULL) TEE_FreeOperation(op);
+       if (op != TEE_HANDLE_NULL)
+               TEE_FreeOperation(op);
        TEE_FreeTransientObject(key);
        return ret;
 }
@@ -657,7 +658,8 @@ TEE_Result KM_DecryptImportedData(
        }
 
 out:
-       if (op != TEE_HANDLE_NULL) TEE_FreeOperation(op);
+       if (op != TEE_HANDLE_NULL)
+               TEE_FreeOperation(op);
        TEE_FreeTransientObject(key);
        return ret;
 }
@@ -705,7 +707,8 @@ TEE_Result KM_DecryptDataWithPwd(const KM_PwdData* pwd, void *in, size_t in_size
        }
 
 out:
-       if (op != TEE_HANDLE_NULL) TEE_FreeOperation(op);
+       if (op != TEE_HANDLE_NULL)
+               TEE_FreeOperation(op);
        TEE_FreeTransientObject(key);
        return ret;
 }