mirror of
https://github.com/espressif/esp-idf.git
synced 2026-10-18 19:43:17 +03:00
A corrupted segment data_len was only caught by the image length check after all segments had been checksummed/hashed. On chips with 32-bit cache mapping (e.g. ESP32-P4 with CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH) nothing bounds that walk, so a ~1.8 GB data_len trips the task WDT in the app and the RTC WDT in the bootloader, which then reset-loops on the corrupted partition. Check that each segment header and its data lie inside the partition before processing the segment data.