[kernel][dev][intel-rng] fix buffer overflow bug
Noticed this while converting the file to cpp. The code to trim the
amount of memory to memcpy into the outgoing buffer would overflow by up
to 8 bytes per loop.
Never showed up before because the calling code for this either always
asks for a multiple of 8 or copies into a buffer that is at least a
multiple of 8.
Perhaps worth writing an in kernel unit test.
Change-Id: I4363f63360f121d444e4a6df9c8ead5de96b2a1b
Tested: build and verify that the copy does not overflow manually.
diff --git a/kernel/dev/intel_rng/intel-rng.cpp b/kernel/dev/intel_rng/intel-rng.cpp
index 15182de..2d93caf 100644
--- a/kernel/dev/intel_rng/intel-rng.cpp
+++ b/kernel/dev/intel_rng/intel-rng.cpp
@@ -78,7 +78,7 @@
}
continue;
}
- const size_t to_copy = fbl::min(len, sizeof(val));
+ const size_t to_copy = fbl::min(len - written, sizeof(val));
memcpy(static_cast<uint8_t*>(buf) + written, &val, to_copy);
written += to_copy;
}
