Skip to content

Backport 89351 to v4.0 branch: Fix operation bounds check for Flash Map API #89351 #93505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Backport 89351 to v4.0 branch: Fix operation bounds check for Flash Map API #89351 #93505

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd93585
storage/flash_map: Fix is_in_flash_area_bounds
de-nordic Apr 30, 2025
53a4b9a
tests: flash_map: Basic offset/length overflow tests
de-nordic Apr 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion subsys/storage/flash_map/flash_map_priv.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ static inline struct flash_area const *get_flash_area_from_id(int idx)
static inline bool is_in_flash_area_bounds(const struct flash_area *fa,
off_t off, size_t len)
{
return (off >= 0) && ((off + len) <= fa->fa_size);
return (off >= 0) && (off < fa->fa_size) && (len <= (fa->fa_size - off));
}

#endif /* ZEPHYR_SUBSYS_STORAGE_FLASH_MAP_PRIV_H_ */
20 changes: 20 additions & 0 deletions tests/subsys/storage/flash_map/src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,4 +333,24 @@ ZTEST(flash_map, test_flash_area_erase_and_flatten)
i + fa->fa_off);
}

ZTEST(flash_map, test_parameter_overflows)
{
const struct flash_area *fa;
uint8_t dst_buf[FLASH_AREA_COPY_SIZE];
int rc;

fa = FIXED_PARTITION(SLOT1_PARTITION);
/* -1 cast to size_t gives us max size_t value, added to offset of 1,
* it will overflow to 0.
*/
rc = flash_area_read(fa, 1, dst_buf, (size_t)(-1));
zassert_equal(rc, -EINVAL, "1: Overflow should have been detected");
/* Here we have offset 1 below size of area, with added max size_t
* it upper bound of read range should overflow to:
* (max(size_t) + fa->fa_size - 1) mod (max(size_t)) == fa->fa_size - 2
*/
rc = flash_area_read(fa, fa->fa_size - 1, dst_buf, (size_t)(-1));
zassert_equal(rc, -EINVAL, "2: Overflow should have been detected");
}

ZTEST_SUITE(flash_map, NULL, NULL, NULL, NULL, NULL);
Loading