diff options
| author | Kévin Redon <kredon@sysmocom.de> | 2018-06-01 11:02:49 +0200 |
|---|---|---|
| committer | Harald Welte <laforge@gnumonks.org> | 2018-06-29 20:07:31 +0200 |
| commit | 318309f30f8a799d64d536578c5e6e60f1d61d6a (patch) | |
| tree | 146ad79dbc39c6baaf32cd9b86444300ad3041c2 /firmware/apps | |
| parent | 0828b914e7820c3184d18e4e2a9cbe9cfc2f2a27 (diff) | |
dfu: fix address destination check and add stack overwrite check in USBDFU_handle_dnload
During DFU download the destination start address is checked to not exceed the
RAM or flash end address, but it is also necessary to check if the end of the
data to be downloaded is also within the allowed range.
When downloading to RAM it is also necessary to check if the data to be
downloaded does not overwrite (i.e. corrupt) the stack.
Diffstat (limited to 'firmware/apps')
| -rw-r--r-- | firmware/apps/dfu/main.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/firmware/apps/dfu/main.c b/firmware/apps/dfu/main.c index 01cf1e0..a90b9ac 100644 --- a/firmware/apps/dfu/main.c +++ b/firmware/apps/dfu/main.c @@ -21,22 +21,24 @@ unsigned int g_unique_id[4]; #define IFLASH_END ((uint8_t *)IFLASH_ADDR + IFLASH_SIZE) #define IRAM_END ((uint8_t *)IRAM_ADDR + IRAM_SIZE) -/* incoming call-back: Host has transfered 'len' bytes (stored at +/* incoming call-back: Host has transferred 'len' bytes (stored at * 'data'), which we shall write to 'offset' into the partition - * associated with 'altif'. Guaranted to be les than + * associated with 'altif'. Guaranted to be less than * BOARD_DFU_PAGE_SIZE */ int USBDFU_handle_dnload(uint8_t altif, unsigned int offset, uint8_t *data, unsigned int len) { uint32_t addr; int rc; + /* address of the last allocated variable on the stack */ + uint32_t stack_addr = (uint32_t)&rc; printf("dnload(altif=%u, offset=%u, len=%u)\n\r", altif, offset, len); switch (altif) { case ALTIF_RAM: addr = RAM_ADDR(offset); - if (addr > IRAM_ADDR + IRAM_SIZE) { + if (addr + len >= IRAM_ADDR + IRAM_SIZE || addr + len >= stack_addr) { g_dfu->state = DFU_STATE_dfuERROR; g_dfu->status = DFU_STATUS_errADDRESS; return DFU_RET_STALL; @@ -45,7 +47,7 @@ int USBDFU_handle_dnload(uint8_t altif, unsigned int offset, return DFU_RET_ZLP; case ALTIF_FLASH: addr = FLASH_ADDR(offset); - if (addr > IFLASH_ADDR + IFLASH_SIZE) { + if (addr + len >= IFLASH_ADDR + IFLASH_SIZE) { g_dfu->state = DFU_STATE_dfuERROR; g_dfu->status = DFU_STATUS_errADDRESS; return DFU_RET_STALL; |