From ce36e042082b38c9ed684555e44ff0f87edab256 Mon Sep 17 00:00:00 2001
From: Kody Stribrny <89810515+kstribrnAmzn@users.noreply.github.com>
Date: Fri, 21 Aug 2026 09:38:33 -0700
Subject: [PATCH] fix(armv8m): Reject undersized secure stack in
 AllocateContext (#1474)

Gate against undersized stack values which do not account for fixed values.

Thanks @aggarg for the help developing this!
---
 portable/ARMv8M/secure/context/secure_context.c   | 6 +++++-
 portable/GCC/ARM_CM23/secure/secure_context.c     | 6 +++++-
 portable/GCC/ARM_CM33/secure/secure_context.c     | 6 +++++-
 portable/GCC/ARM_CM35P/secure/secure_context.c    | 6 +++++-
 portable/GCC/ARM_CM52/secure/secure_context.c     | 6 +++++-
 portable/GCC/ARM_CM55/secure/secure_context.c     | 6 +++++-
 portable/GCC/ARM_CM85/secure/secure_context.c     | 6 +++++-
 portable/GCC/ARM_STAR_MC3/secure/secure_context.c | 6 +++++-
 portable/IAR/ARM_CM23/secure/secure_context.c     | 6 +++++-
 portable/IAR/ARM_CM33/secure/secure_context.c     | 6 +++++-
 portable/IAR/ARM_CM35P/secure/secure_context.c    | 6 +++++-
 portable/IAR/ARM_CM52/secure/secure_context.c     | 6 +++++-
 portable/IAR/ARM_CM55/secure/secure_context.c     | 6 +++++-
 portable/IAR/ARM_CM85/secure/secure_context.c     | 6 +++++-
 portable/IAR/ARM_STAR_MC3/secure/secure_context.c | 6 +++++-
 15 files changed, 75 insertions(+), 15 deletions(-)

diff --git a/portable/ARMv8M/secure/context/secure_context.c b/portable/ARMv8M/secure/context/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/ARMv8M/secure/context/secure_context.c
+++ b/portable/ARMv8M/secure/context/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/GCC/ARM_CM23/secure/secure_context.c b/portable/GCC/ARM_CM23/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/GCC/ARM_CM23/secure/secure_context.c
+++ b/portable/GCC/ARM_CM23/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/GCC/ARM_CM33/secure/secure_context.c b/portable/GCC/ARM_CM33/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/GCC/ARM_CM33/secure/secure_context.c
+++ b/portable/GCC/ARM_CM33/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/GCC/ARM_CM35P/secure/secure_context.c b/portable/GCC/ARM_CM35P/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/GCC/ARM_CM35P/secure/secure_context.c
+++ b/portable/GCC/ARM_CM35P/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/GCC/ARM_CM52/secure/secure_context.c b/portable/GCC/ARM_CM52/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/GCC/ARM_CM52/secure/secure_context.c
+++ b/portable/GCC/ARM_CM52/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/GCC/ARM_CM55/secure/secure_context.c b/portable/GCC/ARM_CM55/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/GCC/ARM_CM55/secure/secure_context.c
+++ b/portable/GCC/ARM_CM55/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/GCC/ARM_CM85/secure/secure_context.c b/portable/GCC/ARM_CM85/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/GCC/ARM_CM85/secure/secure_context.c
+++ b/portable/GCC/ARM_CM85/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/GCC/ARM_STAR_MC3/secure/secure_context.c b/portable/GCC/ARM_STAR_MC3/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/GCC/ARM_STAR_MC3/secure/secure_context.c
+++ b/portable/GCC/ARM_STAR_MC3/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/IAR/ARM_CM23/secure/secure_context.c b/portable/IAR/ARM_CM23/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/IAR/ARM_CM23/secure/secure_context.c
+++ b/portable/IAR/ARM_CM23/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/IAR/ARM_CM33/secure/secure_context.c b/portable/IAR/ARM_CM33/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/IAR/ARM_CM33/secure/secure_context.c
+++ b/portable/IAR/ARM_CM33/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/IAR/ARM_CM35P/secure/secure_context.c b/portable/IAR/ARM_CM35P/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/IAR/ARM_CM35P/secure/secure_context.c
+++ b/portable/IAR/ARM_CM35P/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/IAR/ARM_CM52/secure/secure_context.c b/portable/IAR/ARM_CM52/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/IAR/ARM_CM52/secure/secure_context.c
+++ b/portable/IAR/ARM_CM52/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/IAR/ARM_CM55/secure/secure_context.c b/portable/IAR/ARM_CM55/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/IAR/ARM_CM55/secure/secure_context.c
+++ b/portable/IAR/ARM_CM55/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/IAR/ARM_CM85/secure/secure_context.c b/portable/IAR/ARM_CM85/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/IAR/ARM_CM85/secure/secure_context.c
+++ b/portable/IAR/ARM_CM85/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else
diff --git a/portable/IAR/ARM_STAR_MC3/secure/secure_context.c b/portable/IAR/ARM_STAR_MC3/secure/secure_context.c
index a7e13734d..5e6ae3fe6 100644
--- a/portable/IAR/ARM_STAR_MC3/secure/secure_context.c
+++ b/portable/IAR/ARM_STAR_MC3/secure/secure_context.c
@@ -214,8 +214,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_Init( void )
         if( ulSecureContextIndex < secureconfigMAX_SECURE_CONTEXTS )
         {
             /* Allocate the stack space if possible. */
-            if( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) )
+            if( ( ulSecureStackSize < securecontextSTACK_SEAL_SIZE ) ||
+                ( ulSecureStackSize > ( UINT32_MAX - securecontextSTACK_SEAL_SIZE ) ) )
             {
+                /* Reject stacks that are too small (the CONTROL word would be
+                 * written before the allocation, corrupting the secure heap)
+                 * and sizes that would overflow when the seal size is added. */
                 pucStackMemory = NULL;
             }
             else