Skip to content

Commit 566bc34

Browse files
committed
tests: flash_map: Basic offset/length overflow tests
Test integer overflow on Flash Area operation parameters. All functions call the same is_in_flash_area_bounds function for parameter verification, so it was enough to test parameter checks of flash_read. Signed-off-by: Dominik Ermel <[email protected]> (cherry picked from commit 71a329f)
1 parent 97cf162 commit 566bc34

File tree

1 file changed

+20
-0
lines changed
  • tests/subsys/storage/flash_map/src

1 file changed

+20
-0
lines changed

tests/subsys/storage/flash_map/src/main.c

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -333,4 +333,24 @@ ZTEST(flash_map, test_flash_area_erase_and_flatten)
333333
i + fa->fa_off);
334334
}
335335

336+
ZTEST(flash_map, test_parameter_overflows)
337+
{
338+
const struct flash_area *fa;
339+
uint8_t dst_buf[FLASH_AREA_COPY_SIZE];
340+
int rc;
341+
342+
fa = FIXED_PARTITION(SLOT1_PARTITION);
343+
/* -1 cast to size_t gives us max size_t value, added to offset of 1,
344+
* it will overflow to 0.
345+
*/
346+
rc = flash_area_read(fa, 1, dst_buf, (size_t)(-1));
347+
zassert_equal(rc, -EINVAL, "1: Overflow should have been detected");
348+
/* Here we have offset 1 below size of area, with added max size_t
349+
* it upper bound of read range should overflow to:
350+
* (max(size_t) + fa->fa_size - 1) mod (max(size_t)) == fa->fa_size - 2
351+
*/
352+
rc = flash_area_read(fa, fa->fa_size - 1, dst_buf, (size_t)(-1));
353+
zassert_equal(rc, -EINVAL, "2: Overflow should have been detected");
354+
}
355+
336356
ZTEST_SUITE(flash_map, NULL, NULL, NULL, NULL, NULL);

0 commit comments

Comments
 (0)