Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(sdspi): reject oversized pre-read data before block receive

Browse Source 
Guard start_command_read_blocks against cards that place TOKEN_BLOCK_START so early that extra_data_size exceeds the bytes expected on the current iteration. Without this check, the unsigned subtraction for will_receive underflows and propagates into memset, SPI transaction length, and memcpy counts against the fixed 516-byte block buffer.
This commit is contained in:
morris
2026-06-30 17:24:54 +08:00
parent 612eb0b97f
commit 8e8be0cc7f
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
components/esp_driver_sdspi/src/sdspi_host.c
View File

@@ -809,7 +809,12 @@ static esp_err_t start_command_read_blocks(slot_info_t *slot, sdspi_hw_cmd_t *cm
}
// Arrange RX buffer
size_t will_receive = MIN(rx_length, SDSPI_MAX_DATA_LEN) - extra_data_size;
size_t expected_data_size = MIN(rx_length, SDSPI_MAX_DATA_LEN);
if (extra_data_size > expected_data_size) {
ESP_LOGD(TAG, "%s: invalid extra data size %u (expected <= %u)", __func__, (unsigned)extra_data_size, (unsigned)expected_data_size);
return ESP_ERR_INVALID_RESPONSE;
}
size_t will_receive = expected_data_size - extra_data_size;
uint8_t* rx_data;
ret = get_block_buf(slot, &rx_data);
if (ret != ESP_OK) {