Skip to content

Bug/security scan - #327

Merged
ivila merged 3 commits into
apache:mainfrom
ivila:bug/security-scan
Oct 12, 2026
Merged

ivila merged 3 commits into
apache:mainfrom
ivila:bug/security-scan

Conversation

@ivila

@ivila ivila commented Oct 12, 2026

Copy link
Copy Markdown
Contributor
  • Identity::login_type no longer panics on unnamed login values.
  • The generated TA header escapes config strings instead of splicing
    them as source text.
  • UDP socket errors resolve through the UDP vtable, not TCP.

ivila added 3 commits October 12, 2026 15:45
Derive `LoginType` with num_enum's `FromPrimitive`/`IntoPrimitive`
and an `Unknown(u32)` catch-all, as `ErrorKind` does, so
`Identity::login_type` maps an unnamed login to data instead of
reaching the `panic!` for the seven named `TEE_LOGIN_*` constants. In
a TA that panic calls `TEE_Panic`, killing the instance and every
session on it. The raw value still round-trips through `Into<u32>`.
Build the generated byte-string literal as a token with
`Literal::byte_string` instead of formatting the value into source
text and re-parsing it. A quote in a config string no longer closes
the literal and splices further items into the signed TA; reachable
from `CARGO_PKG_DESCRIPTION` through the default
`new_default_with_cargo_env`, the pattern `optee-teec-build` follows.
`handle_socket_operation_error` read the protocol-specific error via
`TEE_tcpSocket` in both branches, but `UdpAdapter::send` and
`UdpAdapter::recv` routed their failures through it too. The GP TEE
Sockets API only allows a handle to be passed to methods of the
instance that created it, so thread the owning `TEE_iSocket` through
and pass `TEE_tcpSocket` or `TEE_udpSocket` at the call sites.
OP-TEE 4.10 points both instances' `error` at the same
protocol-agnostic function, so behaviour is unchanged there.
@ivila ivila added the bug Something isn't working label Oct 12, 2026
@ivila
ivila merged commit 594233b into apache:main Oct 12, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant