espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-10-01 21:37:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

[posix] fix SPI platform driver sanity check boundaries (#13236)

Browse Source 
This commit corrects the SPI frame sanity checks in the POSIX platform
driver (`spi_interface.cpp`).

Previously, the sanity checks compared `mSpiSlaveDataLen` and
`slaveAcceptLen` against `kMaxFrameSize` (8192). However,
`mSpiSlaveDataLen` is the payload size, which excludes the 5-byte SPI
frame header. If the slave advertised a data length of exactly
`kMaxFrameSize` (8192), it would pass the sanity check, but the
subsequent `DoSpiTransfer` would request a transfer length of
`kMaxFrameSize + kSpiFrameHeaderSize + alignment` (e.g. 8213 bytes).
This would cause an out-of-bounds read on `mSpiTxFrameBuffer` which is
sized `kMaxFrameSize + kSpiAlignAllowanceMax` (8208 bytes).

This commit updates the sanity checks to use
`kMaxFrameSize - kSpiFrameHeaderSize` as the maximum allowed payload
length, ensuring that worst-case transfers always fit within the
tx buffer allocation.
This commit is contained in:
Jonathan Hui
2026-06-11 18:00:38 -07:00
committed by GitHub
parent 1f8d922465
commit 11acd4a26e
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/posix/platform/spi_interface.cpp
+5 -3
View File
@@ -412,8 +412,9 @@ otError SpiInterface::PushPullSpi(void)
txFrame.SetHeaderAcceptLen(0); txFrame.SetHeaderAcceptLen(0);
txFrame.SetHeaderDataLen(0); txFrame.SetHeaderDataLen(0);
// Sanity check. // Sanity check. The header `data_len` carries the payload length only
if (mSpiSlaveDataLen > kMaxFrameSize) // (it excludes header size), so the largest valid value is the MTU.
if (mSpiSlaveDataLen > kMaxFrameSize - kSpiFrameHeaderSize)
{ {
mSpiSlaveDataLen = 0; mSpiSlaveDataLen = 0;
} }
@@ -517,7 +518,8 @@ otError SpiInterface::PushPullSpi(void)
slaveAcceptLen = rxFrame.GetHeaderAcceptLen(); slaveAcceptLen = rxFrame.GetHeaderAcceptLen();
mSpiSlaveDataLen = rxFrame.GetHeaderDataLen(); mSpiSlaveDataLen = rxFrame.GetHeaderDataLen();
if (!rxFrame.IsValid() || (slaveAcceptLen > kMaxFrameSize) || (mSpiSlaveDataLen > kMaxFrameSize)) if (!rxFrame.IsValid() || (slaveAcceptLen > kMaxFrameSize - kSpiFrameHeaderSize) ||
(mSpiSlaveDataLen > kMaxFrameSize - kSpiFrameHeaderSize))
{ {
mInterfaceMetrics.mTransferredGarbageFrameCount++; mInterfaceMetrics.mTransferredGarbageFrameCount++;
mSpiTxRefusedCount++; mSpiTxRefusedCount++;