From 8b477360eb4c775fd7a241d0bf6869dae8158581 Mon Sep 17 00:00:00 2001 From: Andrew Thoelke Date: Mon, 10 Aug 2026 12:36:11 +0100 Subject: [PATCH] Clarify Crypto buffer access lifetime --- doc/crypto/appendix/history.rst | 1 + doc/crypto/overview/conventions.rst | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/doc/crypto/appendix/history.rst b/doc/crypto/appendix/history.rst index 050497ff..657080ad 100644 --- a/doc/crypto/appendix/history.rst +++ b/doc/crypto/appendix/history.rst @@ -18,6 +18,7 @@ Changes in the draft GlobalPlatform publication revision Clarifications and fixes ~~~~~~~~~~~~~~~~~~~~~~~~ +* Clarified that an implementation accesses memory referenced by a pointer or buffer parameter only during the function call, and consumes input buffers before returning. * Corrected the WPA3-SAE operation example code: the send-confirm counter input step is `PSA_PAKE_STEP_CONFIRM_COUNT`, and the shared key is extracted from the ``wpa3_sae`` operation. * Corrected the SPAKE2+ operation example code: the Prover input step for the Verifier confirmation value is `PSA_PAKE_STEP_CONFIRM`. diff --git a/doc/crypto/overview/conventions.rst b/doc/crypto/overview/conventions.rst index 85e42b66..87861a6a 100644 --- a/doc/crypto/overview/conventions.rst +++ b/doc/crypto/overview/conventions.rst @@ -211,6 +211,11 @@ readable, and the implementation must be able to write to a non-buffer output parameter and read back the same value, as explained in :secref:`stability-of-parameters`. +The implementation accesses memory referenced by a pointer or buffer parameter +only during the function call. In particular, it must consume input buffers +before returning and must not access the caller's memory after the function +returns. + Input buffer sizes ^^^^^^^^^^^^^^^^^^