Passing variable sized buffers to enclaves

Hi,

We are fuzzing Intel SGX SDK applications with the threat model that we do not trust the untrusted stack in the system. This includes the untrusted operating system, application, and the untrusted runtime (urts). To this end, we fuzz arguments passed in for ecalls. While fuzzing some applications, we found that some applications pass in variable-sized buffers to enclaves, with the buffer and variable passed in as separate arguments. While fuzzing a careful discrepancy between the actual buffer size and the buffer size argument causes the memcpy from untrusted arguments to trusted arguments results in a segfault. For instance, consider this code from trts:
```
if (_tmp_msg_data != NULL && _len_msg_data != 0) {
_in_msg_data = (uint8_t*)malloc(_len_msg_data);
if (_in_msg_data == NULL) {
status = SGX_ERROR_OUT_OF_MEMORY;
goto err;
}

memcpy((void*)_in_msg_data, _tmp_msg_data, _len_msg_data);
}
```
Here _len_msg_data is the size of the buffer passed in, while _tmp_msg_data is the data passed in. If _len_msg_data is small to pass the memory allocation but large enough to reach into unmapped memory it triggers a segfault inside the enclave.

This has been a problem in various SGX projects. What should be done here to sanitize such variable-sized buffers inside trts?