From f04ecee9f645c0fe5e2a110b5cdbbc663827ffa8 Mon Sep 17 00:00:00 2001
From: Vincent Dupont <vincent@otakeys.com>
Date: Mon, 22 Jan 2018 16:14:51 +0100
Subject: [PATCH] mtd_native: fix overlapping pages write check
---
cpu/native/mtd/mtd_native.c | 5 ++---
tests/unittests/tests-mtd/tests-mtd.c | 14 +++++++++++++-
2 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/cpu/native/mtd/mtd_native.c b/cpu/native/mtd/mtd_native.c
index 5c3abaa0d6..fd353a913c 100644
--- a/cpu/native/mtd/mtd_native.c
+++ b/cpu/native/mtd/mtd_native.c
@@ -79,14 +79,13 @@ static int _write(mtd_dev_t *dev, const void *buff, uint32_t addr, uint32_t size
{
mtd_native_dev_t *_dev = (mtd_native_dev_t*) dev;
size_t mtd_size = dev->sector_count * dev->pages_per_sector * dev->page_size;
- size_t sector_size = dev->pages_per_sector * dev->page_size;
- DEBUG("mtd_native: write from page %" PRIu32 " count %" PRIu32 "\n", addr, size);
+ DEBUG("mtd_native: write from 0x%" PRIx32 " count %" PRIu32 "\n", addr, size);
if (addr + size > mtd_size) {
return -EOVERFLOW;
}
- if (((addr % sector_size) + size) > sector_size) {
+ if (((addr % dev->page_size) + size) > dev->page_size) {
return -EOVERFLOW;
}
diff --git a/tests/unittests/tests-mtd/tests-mtd.c b/tests/unittests/tests-mtd/tests-mtd.c
index cc581021fb..277f251c7a 100644
--- a/tests/unittests/tests-mtd/tests-mtd.c
+++ b/tests/unittests/tests-mtd/tests-mtd.c
@@ -69,7 +69,7 @@ static int write(mtd_dev_t *dev, const void *buff, uint32_t addr, uint32_t size)
if (addr + size > sizeof(dummy_memory)) {
return -EOVERFLOW;
}
- if (size > PAGE_SIZE) {
+ if (((addr % PAGE_SIZE) + size) > PAGE_SIZE) {
return -EOVERFLOW;
}
memcpy(dummy_memory + addr, buff, size);
@@ -212,6 +212,18 @@ static void test_mtd_write_read(void)
ret = mtd_write(dev, buf, (dev->pages_per_sector * dev->page_size * dev->sector_count)
- (sizeof(buf) / 2), sizeof(buf));
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
+
+ /* out of bounds write (more than page size) */
+ const size_t page_size = dev->page_size;
+ const uint8_t buf_page[page_size + 1];
+ ret = mtd_write(dev, buf_page, 0, sizeof(buf_page));
+ TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
+
+ /* pages overlap write */
+ ret = mtd_write(dev, buf, dev->page_size - (sizeof(buf) / 2), sizeof(buf));
+ TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
+ ret = mtd_write(dev, buf_page, 1, sizeof(buf_page) - 1);
+ TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
}
#ifdef MTD_0
--
GitLab