storage/flash_map: Fix is_in_flash_area_bounds

de-nordic · de-nordic · commit 5e2e3810bc7b · 2025-07-22T12:31:15.000Z
Prevent possible overflow in is_in_flash_area_bounds while validating offset and length of an operation. Fixes #89349 Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no> (cherry picked from commit 3d4b427)
diff --git a/subsys/storage/flash_map/flash_map_priv.h b/subsys/storage/flash_map/flash_map_priv.h
@@ -33,7 +33,7 @@ static inline struct flash_area const *get_flash_area_from_id(int idx)
 static inline bool is_in_flash_area_bounds(const struct flash_area *fa,
 					   off_t off, size_t len)
 {
-	return (off >= 0) && ((off + len) <= fa->fa_size);
+	return (off >= 0) && (off < fa->fa_size) && (len <= (fa->fa_size - off));
 }
 
 #endif /* ZEPHYR_SUBSYS_STORAGE_FLASH_MAP_PRIV_H_ */

Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ static inline struct flash_area const *get_flash_area_from_id(int idx)`
`33`	`33`	`static inline bool is_in_flash_area_bounds(const struct flash_area *fa,`
`34`	`34`	`off_t off, size_t len)`
`35`	`35`	`{`
`36`		`- return (off >= 0) && ((off + len) <= fa->fa_size);`
	`36`	`+ return (off >= 0) && (off < fa->fa_size) && (len <= (fa->fa_size - off));`
`37`	`37`	`}`
`38`	`38`
`39`	`39`	`#endif /* ZEPHYR_SUBSYS_STORAGE_FLASH_MAP_PRIV_H_ */`