michaelh/zephyr
1
0
Fork 0
Code Releases Activity

espi: mchp_xec_v2: Fix possible buffer overflow

Browse source 
Check the packet lenght in flash_write operation beforeSigned-off-by
copying it to an internal buffer.

Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
This commit is contained in:
Flavio Ceolin 2023-08-06 23:30:29 -07:00 • committed by Martí Bolívar
commit c5bb002f77
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
drivers/espi/espi_mchp_xec_v2.c
View file

@ -524,6 +524,11 @@ static int espi_xec_flash_write(const struct device *dev,
LOG_DBG("%s", __func__); LOG_DBG("%s", __func__);
if (sizeof(target_mem) < pckt->len) {
LOG_ERR("Packet length is too big");
return -ENOMEM;
}
if (!(regs->FCSTS & MCHP_ESPI_FC_STS_CHAN_EN)) { if (!(regs->FCSTS & MCHP_ESPI_FC_STS_CHAN_EN)) {
LOG_ERR("Flash channel is disabled"); LOG_ERR("Flash channel is disabled");
return -EIO; return -EIO;