michaelh/zephyr
1
0
Fork 0
Code Releases Activity

drivers: i2c: ambiq: buffer overflow issue fixed

Browse source 
Bugfix for possible out-of-bounds operation when buffer address
is not 4 bytes aligned

Signed-off-by: Hao Luo <hluo@ambiq.com>
This commit is contained in:
Hao Luo 2025-06-17 16:12:56 +08:00 • committed by Dan Kalowsky
commit f1348d3954
1 changed files with 4 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/i2c/i2c_ambiq.c
View file

@ -124,11 +124,9 @@ static int i2c_ambiq_read(const struct device *dev, struct i2c_msg *hdr_msg,
return -E2BIG;
}
#if defined(CONFIG_SOC_SERIES_APOLLO3X)
trans.ui32Instr = (*(uint32_t *)hdr_msg->buf)
& (0xFFFFFFFFUL >> (32 - (hdr_msg->len * 8)));
memcpy(&trans.ui32Instr, hdr_msg->buf, hdr_msg->len);
#else
trans.ui64Instr = (*(uint64_t *)hdr_msg->buf)
& (0xFFFFFFFFFFFFFFFFULL >> (64 - (hdr_msg->len * 8)));
memcpy(&trans.ui64Instr, hdr_msg->buf, hdr_msg->len);
#endif
trans.ui32InstrLen = hdr_msg->len;
}
@ -179,11 +177,9 @@ static int i2c_ambiq_write(const struct device *dev, struct i2c_msg *hdr_msg,
return -E2BIG;
}
#if defined(CONFIG_SOC_SERIES_APOLLO3X)
trans.ui32Instr = (*(uint32_t *)hdr_msg->buf)
& (0xFFFFFFFFUL >> (32 - (hdr_msg->len * 8)));
memcpy(&trans.ui32Instr, hdr_msg->buf, hdr_msg->len);
#else
trans.ui64Instr = (*(uint64_t *)hdr_msg->buf)
& (0xFFFFFFFFFFFFFFFFULL >> (64 - (hdr_msg->len * 8)));
memcpy(&trans.ui64Instr, hdr_msg->buf, hdr_msg->len);
#endif
trans.ui32InstrLen = hdr_msg->len;
}