Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bootloader): prevent unsigned overflow in partition table validation

Browse Source 
The bounds check `pos->offset + pos->size > chip_size` can silently
wrap around when both offset and size are large uint32_t values,
bypassing the validation entirely.

Use `pos->size > chip_size - pos->offset` instead, which is safe
because pos->offset <= chip_size is already verified by the first
condition in the same expression.

Found via https://github.com/Eun0us/esp-fuzzer
This commit is contained in:
Eun0us
2026-02-10 19:11:59 +01:00
parent ffb63db38b
commit fc29190dba
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader_support/src/flash_partitions.c
+1 -1
View File
@@ -23,7 +23,7 @@ esp_err_t esp_partition_table_verify(const esp_partition_info_t *partition_table
if (part->magic == ESP_PARTITION_MAGIC) {
const esp_partition_pos_t *pos = &part->pos;
if (pos->offset > chip_size || pos->offset + pos->size > chip_size) {
if (pos->offset > chip_size || pos->size > chip_size - pos->offset) {
if (log_errors) {
ESP_LOGE(TAG, "partition %d invalid - offset 0x%"PRIx32" size 0x%"PRIx32" exceeds flash chip size 0x%"PRIx32,
num_parts, pos->offset, pos->size, chip_size);