Skip to content
Snippets Groups Projects
Commit f04ecee9 authored by Vincent Dupont's avatar Vincent Dupont
Browse files

mtd_native: fix overlapping pages write check

parent b6fe1368
No related branches found
No related tags found
No related merge requests found
...@@ -79,14 +79,13 @@ static int _write(mtd_dev_t *dev, const void *buff, uint32_t addr, uint32_t size ...@@ -79,14 +79,13 @@ static int _write(mtd_dev_t *dev, const void *buff, uint32_t addr, uint32_t size
{ {
mtd_native_dev_t *_dev = (mtd_native_dev_t*) dev; mtd_native_dev_t *_dev = (mtd_native_dev_t*) dev;
size_t mtd_size = dev->sector_count * dev->pages_per_sector * dev->page_size; size_t mtd_size = dev->sector_count * dev->pages_per_sector * dev->page_size;
size_t sector_size = dev->pages_per_sector * dev->page_size;
DEBUG("mtd_native: write from page %" PRIu32 " count %" PRIu32 "\n", addr, size); DEBUG("mtd_native: write from 0x%" PRIx32 " count %" PRIu32 "\n", addr, size);
if (addr + size > mtd_size) { if (addr + size > mtd_size) {
return -EOVERFLOW; return -EOVERFLOW;
} }
if (((addr % sector_size) + size) > sector_size) { if (((addr % dev->page_size) + size) > dev->page_size) {
return -EOVERFLOW; return -EOVERFLOW;
} }
......
...@@ -69,7 +69,7 @@ static int write(mtd_dev_t *dev, const void *buff, uint32_t addr, uint32_t size) ...@@ -69,7 +69,7 @@ static int write(mtd_dev_t *dev, const void *buff, uint32_t addr, uint32_t size)
if (addr + size > sizeof(dummy_memory)) { if (addr + size > sizeof(dummy_memory)) {
return -EOVERFLOW; return -EOVERFLOW;
} }
if (size > PAGE_SIZE) { if (((addr % PAGE_SIZE) + size) > PAGE_SIZE) {
return -EOVERFLOW; return -EOVERFLOW;
} }
memcpy(dummy_memory + addr, buff, size); memcpy(dummy_memory + addr, buff, size);
...@@ -212,6 +212,18 @@ static void test_mtd_write_read(void) ...@@ -212,6 +212,18 @@ static void test_mtd_write_read(void)
ret = mtd_write(dev, buf, (dev->pages_per_sector * dev->page_size * dev->sector_count) ret = mtd_write(dev, buf, (dev->pages_per_sector * dev->page_size * dev->sector_count)
- (sizeof(buf) / 2), sizeof(buf)); - (sizeof(buf) / 2), sizeof(buf));
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret); TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
/* out of bounds write (more than page size) */
const size_t page_size = dev->page_size;
const uint8_t buf_page[page_size + 1];
ret = mtd_write(dev, buf_page, 0, sizeof(buf_page));
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
/* pages overlap write */
ret = mtd_write(dev, buf, dev->page_size - (sizeof(buf) / 2), sizeof(buf));
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
ret = mtd_write(dev, buf_page, 1, sizeof(buf_page) - 1);
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
} }
#ifdef MTD_0 #ifdef MTD_0
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment