Merge branch 'bugfix/driver_security_fix' into 'master'

fix(drivers): harden bitscrambler against malformed inputs

Closes SEC-513, SEC-512, and SEC-511

See merge request espressif/esp-idf!50582
This commit is contained in:
morris
2026-08-03 10:14:41 +08:00
7 changed files with 128 additions and 11 deletions
@@ -23,6 +23,9 @@ extern "C" {
#define BITSCRAMBLER_LL_GET_HW(num) (((num) == 0) ? (&BITSCRAMBLER) : NULL)
#define BITSCRAMBLER_LL_INST_LEN_WORDS 9 //length of one instruction in 32-bit words as defined by HW
// LUT index register is 11 bits wide, so the LUT address space is 2048 bytes.
#define BITSCRAMBLER_LL_LUT_MAX_BYTES (1U << 11)
#define BITSCRAMBLER_LL_MAX_INST 8
typedef enum {
BITSCRAMBLER_LL_MEM_LP_MODE_SHUT_DOWN, // memory will be powered down during low power stage
@@ -23,6 +23,9 @@ extern "C" {
#define BITSCRAMBLER_LL_GET_HW(num) (((num) == 0) ? (&BITSCRAMBLER) : NULL)
#define BITSCRAMBLER_LL_INST_LEN_WORDS 9 //length of one instruction in 32-bit words as defined by HW
// LUT index register is 11 bits wide, so the LUT address space is 2048 bytes.
#define BITSCRAMBLER_LL_LUT_MAX_BYTES (1U << 11)
#define BITSCRAMBLER_LL_MAX_INST 8
typedef enum {
BITSCRAMBLER_LL_MEM_LP_MODE_SHUT_DOWN, // memory will be powered down during low power stage
@@ -22,6 +22,9 @@ extern "C" {
#define BITSCRAMBLER_LL_GET_HW(num) (((num) == 0) ? (&BITSCRAMBLER) : NULL)
#define BITSCRAMBLER_LL_INST_LEN_WORDS 9 //length of one instruction in 32-bit words as defined by HW
// LUT index register is 11 bits wide, so the LUT address space is 2048 bytes.
#define BITSCRAMBLER_LL_LUT_MAX_BYTES (1U << 11)
#define BITSCRAMBLER_LL_MAX_INST 8
typedef enum {
BITSCRAMBLER_LL_MEM_LP_MODE_DEEP_SLEEP, // memory will enter deep sleep during low power stage, keep memory data