Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

drivers/eeprom/i2c_xx24xx: Integer Overflow in I2C EEPROM ee24xx_seek()

Browse source 
The function seek which allows the user to move the cursor to a particular
offset in order to read and write from EEPROM storage does not validate the
offset is valid. Later, this can cause an out-of-bounds reads or writes.
Note that newpos may store a large value, larger than the size of the EEPROM.

Similar change in the SPI driver.

Tested locally, builds fine.

Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This commit is contained in:
Catalin Visinescu 2026-06-17 17:33:10 -04:00 • committed by Xiang Xiao
parent 687471c0d9
commit 0076f35401
2 changed files with 32 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
drivers/eeprom/i2c_xx24xx.c
View file

@ -570,20 +570,35 @@ static off_t ee24xx_seek(FAR struct file *filep, off_t offset, int whence)
return ret;
}
/* Determine the new, requested file position */
/* Determine the new, requested file position
* For EEPROM sparse files are not allowed.
* "offset" can be negative, "newpos" must be between 0 and eedev->size
*/
switch (whence)
{
case SEEK_CUR:
newpos = filep->f_pos + offset;
if (newpos < 0 || newpos > eedev->size)
{
return -EINVAL;
}
break;
case SEEK_SET:
newpos = offset;
if (newpos < 0 || newpos > eedev->size)
{
return -EINVAL;
}
break;
case SEEK_END:
newpos = eedev->size + offset;
if (newpos < 0 || newpos > eedev->size)
{
return -EINVAL;
}
break;
default:

17
drivers/eeprom/spi_xx25xx.c
View file

@ -929,20 +929,35 @@ static off_t ee25xx_seek(FAR struct file *filep, off_t offset, int whence)
return ret;
}
/* Determine the new, requested file position */
/* Determine the new, requested file position
* For EEPROM sparse files are not allowed.
* "offset" can be negative, "newpos" must be between 0 and eedev->size
*/
switch (whence)
{
case SEEK_CUR:
newpos = filep->f_pos + offset;
if (newpos < 0 || newpos > eedev->size)
{
return -EINVAL;
}
break;
case SEEK_SET:
newpos = offset;
if (newpos < 0 || newpos > eedev->size)
{
return -EINVAL;
}
break;
case SEEK_END:
newpos = eedev->size + offset;
if (newpos < 0 || newpos > eedev->size)
{
return -EINVAL;
}
break;
default: