diff options
| author | HiFiPhile <[email protected]> | 2025-01-22 23:48:57 +0100 |
|---|---|---|
| committer | GitHub <[email protected]> | 2025-01-22 23:48:57 +0100 |
| commit | 597446fbeab9524ba675502c3b6a42d51c0b57ad (patch) | |
| tree | af9dd043734f28228191ce7c7d5c049ba3979886 /examples | |
| parent | feb41eecebdc7544dff066f8004d48f156adada4 (diff) | |
| parent | 19d28a9d15569765b7686380920f660fcd6ceeaf (diff) | |
Merge pull request #2939 from PwnVerse/patch-1
Fix potential out of bounds access in msc_disk.c
Diffstat (limited to 'examples')
| -rw-r--r-- | examples/device/cdc_msc/src/msc_disk.c | 3 | ||||
| -rw-r--r-- | examples/device/cdc_msc_freertos/src/msc_disk.c | 2 |
2 files changed, 5 insertions, 0 deletions
diff --git a/examples/device/cdc_msc/src/msc_disk.c b/examples/device/cdc_msc/src/msc_disk.c index d2f8628f1..c1132bbfc 100644 --- a/examples/device/cdc_msc/src/msc_disk.c +++ b/examples/device/cdc_msc/src/msc_disk.c @@ -192,6 +192,9 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff // out of ramdisk if ( lba >= DISK_BLOCK_NUM ) return -1; + // Check for overflow of offset + bufsize + if ( offset + bufsize >= DISK_BLOCK_SIZE ) return -1; + uint8_t const* addr = msc_disk[lba] + offset; memcpy(buffer, addr, bufsize); diff --git a/examples/device/cdc_msc_freertos/src/msc_disk.c b/examples/device/cdc_msc_freertos/src/msc_disk.c index d2f8628f1..e13c24436 100644 --- a/examples/device/cdc_msc_freertos/src/msc_disk.c +++ b/examples/device/cdc_msc_freertos/src/msc_disk.c @@ -191,6 +191,8 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff // out of ramdisk if ( lba >= DISK_BLOCK_NUM ) return -1; + // Check for overflow of offset + bufsize + if ( offset + bufsize >= DISK_BLOCK_SIZE ) return -1; uint8_t const* addr = msc_disk[lba] + offset; memcpy(buffer, addr, bufsize); |