Skip to content

Fix integer overflow on guest-derived usize arithmetic #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CvvT merged 3 commits into from
Feb 23, 2026
Merged

Fix integer overflow on guest-derived usize arithmetic #6

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6971604
Initial plan
Copilot Feb 23, 2026
6bfe40f
Fix integer overflow vulnerabilities: use wrapping/checked arithmetic…
Copilot Feb 23, 2026
e20f3ca
Revert wrapping_add in signal/mod.rs: sp+size is validated at registr…
Copilot Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion litebox_shim_optee/src/msg_handler.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -703,7 +703,10 @@ fn get_shm_info_from_optee_msg_param_tmem(
let aligned_addr = phys_addr - page_offset as u64;

// Calculate number of pages needed
let num_pages = (page_offset + size).div_ceil(PAGE_SIZE);
let num_pages = page_offset
.checked_add(size)
.ok_or(OpteeSmcReturnCode::EBadAddr)?
.div_ceil(PAGE_SIZE);

// Build page address list
let mut page_addrs = Vec::with_capacity(num_pages);
Expand Down