File _service:obs_scm:CVE-2024-6287-2.patch of Package arm-trusted-firmware

From 954d488a9798f8fda675c6b57c571b469b298f04 Mon Sep 17 00:00:00 2001
From: Yoshifumi Hosoya <yoshifumi.hosoya.wj@renesas.com>
Date: Sun, 23 Apr 2023 21:11:15 +0900
Subject: [PATCH] rcar-gen3: plat: BL2: fix Incorrect Address Range Calculation

Check against all address overlap cases

Reviewed-by: Tomer Fichman <Tomer.Fichman@cymotive.com>
Signed-off-by: Yoshifumi Hosoya <yoshifumi.hosoya.wj@renesas.com>
---
 drivers/renesas/common/io/io_rcar.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/renesas/common/io/io_rcar.c b/drivers/renesas/common/io/io_rcar.c
index 9b29a5be81..21ed411137 100644
--- a/drivers/renesas/common/io/io_rcar.c
+++ b/drivers/renesas/common/io/io_rcar.c
@@ -335,13 +335,18 @@ static int32_t check_load_area(uintptr_t dst, uintptr_t len)
 		 * 2. check:
 		 *      | IMAGE n |
 		 *  | IMAGE n+1 |
+		 * 3. check:
+		 *      | IMAGE n |
+		 *  |    IMAGE n+1    |
 		 *
 		 * */
-		if (((dst > addr_loaded[n].dest) &&
-		     (dst <  addr_loaded[n].dest + addr_loaded[n].length)) ||
-		    (((dst < addr_loaded[n].dest) &&
-		      (dst + len)) > addr_loaded[n].dest)) {
-			ERROR("BL2: image is inside a previous image area.\n");
+		if (((dst >= addr_loaded[n].dest) &&
+		     (dst <=  addr_loaded[n].dest + addr_loaded[n].length)) ||
+		    ((dst + len >= addr_loaded[n].dest) &&
+		     (dst + len <= addr_loaded[n].dest + addr_loaded[n].length)) ||
+		    ((dst <= addr_loaded[n].dest) &&
+		     (dst + len >= addr_loaded[n].dest + addr_loaded[n].length))) {
+			ERROR("BL2: next image overlap a previous image area.\n");
 			result = IO_FAIL;
 		}
 	}