tree 2981c66aa48baa569c9055e7bc3fd9decd08a73d
parent b27cc468202c43d66cf947d578da8d11166201b0
author Pankaj Gupta <pankaj.gupta@nxp.com> 1652807236 +0530
committer Jiafei Pan <Jiafei.Pan@nxp.com> 1669166268 +0800

fix(nxp-crypto): fix coverity issue

In function "desc_length", LSB byte of the first word of the
descriptor will be anded with 0x7F, to get the number of words
constructing the descriptor.

LSB byte of the first word of the descriptor is auto-incremented
with each add_word used while constructing the descriptor.

But if function "desc_add_word" is called more than
MAX_DESC_SIZE_WORDS times, then only the function "desc_length",
can return number of words greater than MAX_DESC_SIZE_WORDS.

This is the condition when core can overwrite the out of bound
memory.

Hence, the following fix is needed:
- Before adding any new word to the descriptor, a check for
  max word length needs to be added, into these functions:
  "desc_add_word" & "desc_add_ptr".

Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Signed-off-by: Jiafei Pan <Jiafei.Pan@nxp.com>
Change-Id: If896cd2e02ecde72fb09c5147119dec4f2f84bc3