mirror of
https://github.com/espressif/esp-idf.git
synced 2026-08-18 06:35:35 +03:00
daae1fb403
esp_partition_write/read/erase_range/mmap in partition_linux.c (the `linux` target backend used by --preview set-target linux / host_test) validated the requested range with `offset + size > partition->size`. When `size` is close to SIZE_MAX, this addition wraps around size_t and can evaluate to a small value, so the check passes even though the request is far out of bounds. A caller passing e.g. esp_partition_write(partition, 1, src, SIZE_MAX) sails through both bounds checks and reaches the byte-copy loop with new_size == SIZE_MAX, causing out-of-bounds reads/writes far past both the caller's buffer and the mmap'd emulated-flash file. Replace all four instances with the overflow-safe form already used by the other esp_partition backends (partition_target.c, partition_bootloader.c, partition_tee.c): `size > partition->size - offset`, which is safe because the preceding check already guarantees offset <= partition->size. Signed-off-by: yi chen <94xhn1@gmail.com>