Skip to content

Commit dd9188d

Browse files
committed
fix(FCS-1612): Fixed a heap corruption issue when using the sdio interface
Reason: `at_sdio_read_data(data, len)` may read out more bytes than `len` due to incorrect if condition checks, leading to memory corruption and causing a crash. Fix: Corrected the `if` condition in `at_sdio_read_data()` to ensure that the number of bytes read does not exceed the specified length (`len`), preventing memory corruption and potential crashes.
1 parent 760e656 commit dd9188d

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

main/interface/sdio/at_sdio_task.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,12 @@ static int32_t at_sdio_read_data(uint8_t *data, int32_t len)
105105
}
106106

107107
esp_at_sdio_list_t *p_list = sp_head;
108-
if (len < p_list->left_len) {
109-
memcpy(data + copy_len, p_list->pbuf + p_list->pos, len);
110-
p_list->pos += len;
111-
p_list->left_len -= len;
112-
copy_len += len;
108+
uint32_t to_read_len = len - copy_len;
109+
if (to_read_len < p_list->left_len) {
110+
memcpy(data + copy_len, p_list->pbuf + p_list->pos, to_read_len);
111+
p_list->pos += to_read_len;
112+
p_list->left_len -= to_read_len;
113+
copy_len += to_read_len;
113114
} else {
114115
memcpy(data + copy_len, p_list->pbuf + p_list->pos, p_list->left_len);
115116
p_list->pos += p_list->left_len;

0 commit comments

Comments
 (0)