From 05ebe7ad4b68685086090f3b648b894a74ee2858 Mon Sep 17 00:00:00 2001 From: morris Date: Tue, 30 Jun 2026 16:52:13 +0800 Subject: [PATCH] fix(adc): add missing input validation for channel and ret_handle - adc_cali_curve_fitting: validate config->chan in check_valid() to prevent OOB access into s_adc_cali_chan_compens compensation table - adc_filter: make s_adc_filter_free idempotent on !UNIT_BINDED SoCs to prevent double-free on repeated adc_del_continuous_iir_filter - adc_cali_line_fitting(esp32): fix config && config typo to config && ret_handle, preventing NULL-pointer dereference --- components/esp_adc/adc_cali_curve_fitting.c | 1 + components/esp_adc/adc_filter.c | 8 ++++++-- components/esp_adc/esp32/adc_cali_line_fitting.c | 5 ++++- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/components/esp_adc/adc_cali_curve_fitting.c b/components/esp_adc/adc_cali_curve_fitting.c index 919614a5fca..366a5a5a7b4 100644 --- a/components/esp_adc/adc_cali_curve_fitting.c +++ b/components/esp_adc/adc_cali_curve_fitting.c @@ -219,6 +219,7 @@ static esp_err_t check_valid(const adc_cali_curve_fitting_config_t *config) { ESP_RETURN_ON_FALSE(config->unit_id < SOC_ADC_PERIPH_NUM, ESP_ERR_INVALID_ARG, TAG, "invalid ADC unit"); ESP_RETURN_ON_FALSE(config->atten < SOC_ADC_ATTEN_NUM, ESP_ERR_INVALID_ARG, TAG, "invalid ADC attenuation"); + ESP_RETURN_ON_FALSE(config->chan < SOC_ADC_CHANNEL_NUM(config->unit_id), ESP_ERR_INVALID_ARG, TAG, "invalid ADC channel"); bool available_oneshot_bitwidth = (config->bitwidth >= SOC_ADC_RTC_MIN_BITWIDTH && config->bitwidth <= SOC_ADC_RTC_MAX_BITWIDTH); bool available_dma_bitwidth = (config->bitwidth >= SOC_ADC_DIGI_MIN_BITWIDTH && config->bitwidth <= SOC_ADC_DIGI_MAX_BITWIDTH); diff --git a/components/esp_adc/adc_filter.c b/components/esp_adc/adc_filter.c index da8ead99ea5..2f6c2a6ac8c 100644 --- a/components/esp_adc/adc_filter.c +++ b/components/esp_adc/adc_filter.c @@ -78,11 +78,15 @@ static esp_err_t s_adc_filter_claim(adc_continuous_handle_t handle, adc_iir_filt static esp_err_t s_adc_filter_free(adc_iir_filter_t *filter_ctx) { assert(filter_ctx); + esp_err_t ret = ESP_ERR_NOT_FOUND; portENTER_CRITICAL(&s_filter_spinlock); - filter_ctx->continuous_ctx->iir_filter[filter_ctx->filter_id] = NULL; + if (filter_ctx->continuous_ctx->iir_filter[filter_ctx->filter_id] != NULL) { + filter_ctx->continuous_ctx->iir_filter[filter_ctx->filter_id] = NULL; + ret = ESP_OK; + } portEXIT_CRITICAL(&s_filter_spinlock); - return ESP_OK; + return ret; } #endif diff --git a/components/esp_adc/esp32/adc_cali_line_fitting.c b/components/esp_adc/esp32/adc_cali_line_fitting.c index 60710818584..57175d56106 100644 --- a/components/esp_adc/esp32/adc_cali_line_fitting.c +++ b/components/esp_adc/esp32/adc_cali_line_fitting.c @@ -154,7 +154,7 @@ typedef struct { esp_err_t adc_cali_create_scheme_line_fitting(const adc_cali_line_fitting_config_t *config, adc_cali_handle_t *ret_handle) { esp_err_t ret = ESP_OK; - ESP_RETURN_ON_FALSE(config && config, ESP_ERR_INVALID_ARG, TAG, "invalid argument: null pointer"); + ESP_RETURN_ON_FALSE(config && ret_handle, ESP_ERR_INVALID_ARG, TAG, "invalid argument: null pointer"); ESP_RETURN_ON_FALSE(config->unit_id < SOC_ADC_PERIPH_NUM, ESP_ERR_INVALID_ARG, TAG, "invalid ADC unit"); ESP_RETURN_ON_FALSE(config->atten < SOC_ADC_ATTEN_NUM, ESP_ERR_INVALID_ARG, TAG, "invalid ADC attenuation"); ESP_RETURN_ON_FALSE(((config->bitwidth >= SOC_ADC_RTC_MIN_BITWIDTH && config->bitwidth <= SOC_ADC_RTC_MAX_BITWIDTH) || config->bitwidth == ADC_BITWIDTH_DEFAULT), ESP_ERR_INVALID_ARG, TAG, "invalid bitwidth"); @@ -204,6 +204,9 @@ esp_err_t adc_cali_create_scheme_line_fitting(const adc_cali_line_fitting_config return ESP_OK; err: + if (chars) { + free(chars); + } if (scheme) { free(scheme); }