From 9a23f70ee0cabad5059dcc1dfd5ffcbff7e61e03 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Tue, 11 Aug 2026 17:31:04 +0100 Subject: [PATCH 1/2] Reject UID 0 in pas_its function changed: psa_its_set, _get, _get_info, _remove Signed-off-by: Yi Wu --- library/psa_crypto_its.h | 16 ++++++++++------ library/psa_its_file.c | 11 ++++++++++- tests/suites/test_suite_psa_its.data | 5 ++++- tests/suites/test_suite_psa_its.function | 19 +++++++++++++++++++ 4 files changed, 43 insertions(+), 8 deletions(-) diff --git a/library/psa_crypto_its.h b/library/psa_crypto_its.h index 877063b878..b2d7336102 100644 --- a/library/psa_crypto_its.h +++ b/library/psa_crypto_its.h @@ -59,8 +59,9 @@ struct psa_storage_info_t { * \retval #PSA_ERROR_NOT_SUPPORTED The operation failed because one or more of the flags provided in `create_flags` is not supported or is not valid * \retval #PSA_ERROR_INSUFFICIENT_STORAGE The operation failed because there was insufficient space on the storage medium * \retval #PSA_ERROR_STORAGE_FAILURE The operation failed because the physical storage has failed (Fatal error) - * \retval #PSA_ERROR_INVALID_ARGUMENT The operation failed because one of the provided pointers(`p_data`) - * is invalid, for example is `NULL` or references memory the caller cannot access + * \retval #PSA_ERROR_INVALID_ARGUMENT The operation failed because \p uid is 0, + * or one of the provided pointers (`p_data`) is invalid, + * for example is `NULL` or references memory the caller cannot access. */ psa_status_t psa_its_set(psa_storage_uid_t uid, uint32_t data_length, @@ -83,8 +84,9 @@ psa_status_t psa_its_set(psa_storage_uid_t uid, * \retval #PSA_ERROR_DOES_NOT_EXIST The operation failed because the provided `uid` value was not found in the storage * \retval #PSA_ERROR_STORAGE_FAILURE The operation failed because the physical storage has failed (Fatal error) * \retval #PSA_ERROR_DATA_CORRUPT The operation failed because stored data has been corrupted - * \retval #PSA_ERROR_INVALID_ARGUMENT The operation failed because one of the provided pointers(`p_data`, `p_data_length`) - * is invalid. For example is `NULL` or references memory the caller cannot access. + * \retval #PSA_ERROR_INVALID_ARGUMENT The operation failed because \p uid is 0, + * or one of the provided pointers (`p_data`) is invalid, + * for example is `NULL` or references memory the caller cannot access. * In addition, this can also happen if an invalid offset was provided. */ psa_status_t psa_its_get(psa_storage_uid_t uid, @@ -104,8 +106,9 @@ psa_status_t psa_its_get(psa_storage_uid_t uid, * \retval #PSA_SUCCESS The operation completed successfully * \retval #PSA_ERROR_DOES_NOT_EXIST The operation failed because the provided uid value was not found in the storage * \retval #PSA_ERROR_DATA_CORRUPT The operation failed because stored data has been corrupted - * \retval #PSA_ERROR_INVALID_ARGUMENT The operation failed because one of the provided pointers(`p_info`) - * is invalid, for example is `NULL` or references memory the caller cannot access + * \retval #PSA_ERROR_INVALID_ARGUMENT The operation failed because \p uid is 0, + * or the provided pointer (`p_info`) is invalid, + * for example is `NULL` or references memory the caller cannot access. */ psa_status_t psa_its_get_info(psa_storage_uid_t uid, struct psa_storage_info_t *p_info); @@ -121,6 +124,7 @@ psa_status_t psa_its_get_info(psa_storage_uid_t uid, * \retval #PSA_ERROR_DOES_NOT_EXIST The operation failed because the provided key value was not found in the storage * \retval #PSA_ERROR_NOT_PERMITTED The operation failed because the provided key value was created with PSA_STORAGE_FLAG_WRITE_ONCE * \retval #PSA_ERROR_STORAGE_FAILURE The operation failed because the physical storage has failed (Fatal error) + * \retval #PSA_ERROR_INVALID_ARGUMENT The operation failed because \p uid is 0. */ psa_status_t psa_its_remove(psa_storage_uid_t uid); diff --git a/library/psa_its_file.c b/library/psa_its_file.c index 9567137483..5bb9e4ef4c 100644 --- a/library/psa_its_file.c +++ b/library/psa_its_file.c @@ -79,6 +79,10 @@ static psa_status_t psa_its_read_file(psa_storage_uid_t uid, psa_its_file_header_t header; size_t n; + if (uid == 0) { + return PSA_ERROR_INVALID_ARGUMENT; + } + *p_stream = NULL; psa_its_fill_filename(uid, filename); *p_stream = fopen(filename, "rb"); @@ -178,7 +182,7 @@ psa_status_t psa_its_set(psa_storage_uid_t uid, psa_storage_create_flags_t create_flags) { if (uid == 0) { - return PSA_ERROR_INVALID_HANDLE; + return PSA_ERROR_INVALID_ARGUMENT; } psa_status_t status = PSA_ERROR_STORAGE_FAILURE; @@ -239,6 +243,11 @@ psa_status_t psa_its_remove(psa_storage_uid_t uid) { char filename[PSA_ITS_STORAGE_FILENAME_LENGTH]; FILE *stream; + + if (uid == 0) { + return PSA_ERROR_INVALID_ARGUMENT; + } + psa_its_fill_filename(uid, filename); stream = fopen(filename, "rb"); if (stream == NULL) { diff --git a/tests/suites/test_suite_psa_its.data b/tests/suites/test_suite_psa_its.data index 06aed07d80..4a41dd6c98 100644 --- a/tests/suites/test_suite_psa_its.data +++ b/tests/suites/test_suite_psa_its.data @@ -29,7 +29,10 @@ Multiple files set_multiple:1:5 Set UID 0 -set_fail:0:"40414243444546474849":PSA_ERROR_INVALID_HANDLE +set_fail:0:"40414243444546474849":PSA_ERROR_INVALID_ARGUMENT + +All functions reject UID 0 +invalid_uid0 Non-existent file nonexistent:1:0 diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index ce3433f2e5..b0993d878c 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -301,3 +301,22 @@ exit: cleanup(); } /* END_CASE */ + +/* BEGIN_CASE */ +void invalid_uid0() +{ + struct psa_storage_info_t info; + + TEST_ASSERT(psa_its_set_wrap(0, 0, NULL, 0) == + PSA_ERROR_INVALID_ARGUMENT); + TEST_ASSERT(psa_its_get(0, 0, 0, NULL, NULL) == + PSA_ERROR_INVALID_ARGUMENT); + TEST_ASSERT(psa_its_get_info(0, &info) == + PSA_ERROR_INVALID_ARGUMENT); + TEST_ASSERT(psa_its_remove(0) == + PSA_ERROR_INVALID_ARGUMENT); + +exit: + cleanup(); +} +/* END_CASE */ From d039c5fe5037f76405d986619c80d90a060130ad Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Wed, 12 Aug 2026 20:18:29 +0100 Subject: [PATCH 2/2] test: use TEST_EQUAL for ITS UID 0 errors Signed-off-by: Yi Wu --- tests/suites/test_suite_psa_its.function | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index b0993d878c..55a0f99660 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -307,14 +307,14 @@ void invalid_uid0() { struct psa_storage_info_t info; - TEST_ASSERT(psa_its_set_wrap(0, 0, NULL, 0) == - PSA_ERROR_INVALID_ARGUMENT); - TEST_ASSERT(psa_its_get(0, 0, 0, NULL, NULL) == - PSA_ERROR_INVALID_ARGUMENT); - TEST_ASSERT(psa_its_get_info(0, &info) == - PSA_ERROR_INVALID_ARGUMENT); - TEST_ASSERT(psa_its_remove(0) == - PSA_ERROR_INVALID_ARGUMENT); + TEST_EQUAL(psa_its_set_wrap(0, 0, NULL, 0), + PSA_ERROR_INVALID_ARGUMENT); + TEST_EQUAL(psa_its_get(0, 0, 0, NULL, NULL), + PSA_ERROR_INVALID_ARGUMENT); + TEST_EQUAL(psa_its_get_info(0, &info), + PSA_ERROR_INVALID_ARGUMENT); + TEST_EQUAL(psa_its_remove(0), + PSA_ERROR_INVALID_ARGUMENT); exit: cleanup();