kaspar/RIOT
1
0
Fork 0
mirror of https://github.com/RIOT-OS/RIOT.git synced 2025-12-16 18:13:49 +01:00
Code Releases Activity

mtd_native: fix overlapping pages write check

Browse Source
This commit is contained in:
Vincent Dupont 2018-01-22 16:14:51 +01:00
parent b6fe13684b
commit f04ecee9f6
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cpu/native/mtd/mtd_native.c
View File

@ -79,14 +79,13 @@ static int _write(mtd_dev_t *dev, const void *buff, uint32_t addr, uint32_t size
{
mtd_native_dev_t *_dev = (mtd_native_dev_t*) dev;
size_t mtd_size = dev->sector_count * dev->pages_per_sector * dev->page_size;
size_t sector_size = dev->pages_per_sector * dev->page_size;
DEBUG("mtd_native: write from page %" PRIu32 " count %" PRIu32 "\n", addr, size);
DEBUG("mtd_native: write from 0x%" PRIx32 " count %" PRIu32 "\n", addr, size);
if (addr + size > mtd_size) {
return -EOVERFLOW;
}
if (((addr % sector_size) + size) > sector_size) {
if (((addr % dev->page_size) + size) > dev->page_size) {
return -EOVERFLOW;
}

14
tests/unittests/tests-mtd/tests-mtd.c
View File

@ -69,7 +69,7 @@ static int write(mtd_dev_t *dev, const void *buff, uint32_t addr, uint32_t size)
if (addr + size > sizeof(dummy_memory)) {
return -EOVERFLOW;
}
if (size > PAGE_SIZE) {
if (((addr % PAGE_SIZE) + size) > PAGE_SIZE) {
return -EOVERFLOW;
}
memcpy(dummy_memory + addr, buff, size);
@ -212,6 +212,18 @@ static void test_mtd_write_read(void)
ret = mtd_write(dev, buf, (dev->pages_per_sector * dev->page_size * dev->sector_count)
- (sizeof(buf) / 2), sizeof(buf));
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
/* out of bounds write (more than page size) */
const size_t page_size = dev->page_size;
const uint8_t buf_page[page_size + 1];
ret = mtd_write(dev, buf_page, 0, sizeof(buf_page));
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
/* pages overlap write */
ret = mtd_write(dev, buf, dev->page_size - (sizeof(buf) / 2), sizeof(buf));
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
ret = mtd_write(dev, buf_page, 1, sizeof(buf_page) - 1);
TEST_ASSERT_EQUAL_INT(-EOVERFLOW, ret);
}
#ifdef MTD_0