Skip to content

Commit cba5ffd

Browse files
committed
Fix NULL pointer dereference in SCCB accessor functions
get_handle_from_address() returns NULL when the given slave address isn't registered in devices[] (e.g. after SCCB_Deinit(), or a concurrent deinit racing an in-flight transaction), logging "Device with address %02x not found" as a designed graceful-failure path. All 6 accessor functions (SCCB_Read, SCCB_Write, SCCB_Read16, SCCB_Write16, SCCB_Read_Addr16_Val16, SCCB_Write_Addr16_Val16) dereferenced that return value unconditionally, turning the intended error path into a NULL pointer dereference / crash. Add a NULL check before each dereference, returning the same failure value each function already uses for I2C errors (0 for reads, -1 for writes), consistent with this file's existing error-handling convention.
1 parent 202df95 commit cba5ffd

1 file changed

Lines changed: 36 additions & 6 deletions

File tree

driver/sccb-ng.c

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,12 @@ int SCCB_Probe(uint8_t slv_addr)
225225

226226
uint8_t SCCB_Read(uint8_t slv_addr, uint8_t reg)
227227
{
228-
i2c_master_dev_handle_t dev_handle = *(get_handle_from_address(slv_addr));
228+
i2c_master_dev_handle_t *dev_handle_ptr = get_handle_from_address(slv_addr);
229+
if (dev_handle_ptr == NULL)
230+
{
231+
return 0;
232+
}
233+
i2c_master_dev_handle_t dev_handle = *dev_handle_ptr;
229234

230235
uint8_t tx_buffer[1] = { reg };
231236
uint8_t rx_buffer[1] = { 0 };
@@ -267,7 +272,12 @@ uint8_t SCCB_Read(uint8_t slv_addr, uint8_t reg)
267272

268273
int SCCB_Write(uint8_t slv_addr, uint8_t reg, uint8_t data)
269274
{
270-
i2c_master_dev_handle_t dev_handle = *(get_handle_from_address(slv_addr));
275+
i2c_master_dev_handle_t *dev_handle_ptr = get_handle_from_address(slv_addr);
276+
if (dev_handle_ptr == NULL)
277+
{
278+
return -1;
279+
}
280+
i2c_master_dev_handle_t dev_handle = *dev_handle_ptr;
271281

272282
uint8_t tx_buffer[2];
273283
tx_buffer[0] = reg;
@@ -285,7 +295,12 @@ int SCCB_Write(uint8_t slv_addr, uint8_t reg, uint8_t data)
285295

286296
uint8_t SCCB_Read16(uint8_t slv_addr, uint16_t reg)
287297
{
288-
i2c_master_dev_handle_t dev_handle = *(get_handle_from_address(slv_addr));
298+
i2c_master_dev_handle_t *dev_handle_ptr = get_handle_from_address(slv_addr);
299+
if (dev_handle_ptr == NULL)
300+
{
301+
return 0;
302+
}
303+
i2c_master_dev_handle_t dev_handle = *dev_handle_ptr;
289304

290305
uint8_t rx_buffer[1];
291306

@@ -304,7 +319,12 @@ uint8_t SCCB_Read16(uint8_t slv_addr, uint16_t reg)
304319

305320
int SCCB_Write16(uint8_t slv_addr, uint16_t reg, uint8_t data)
306321
{
307-
i2c_master_dev_handle_t dev_handle = *(get_handle_from_address(slv_addr));
322+
i2c_master_dev_handle_t *dev_handle_ptr = get_handle_from_address(slv_addr);
323+
if (dev_handle_ptr == NULL)
324+
{
325+
return -1;
326+
}
327+
i2c_master_dev_handle_t dev_handle = *dev_handle_ptr;
308328

309329
uint8_t tx_buffer[3];
310330
tx_buffer[0] = reg >> 8;
@@ -322,7 +342,12 @@ int SCCB_Write16(uint8_t slv_addr, uint16_t reg, uint8_t data)
322342

323343
uint16_t SCCB_Read_Addr16_Val16(uint8_t slv_addr, uint16_t reg)
324344
{
325-
i2c_master_dev_handle_t dev_handle = *(get_handle_from_address(slv_addr));
345+
i2c_master_dev_handle_t *dev_handle_ptr = get_handle_from_address(slv_addr);
346+
if (dev_handle_ptr == NULL)
347+
{
348+
return 0;
349+
}
350+
i2c_master_dev_handle_t dev_handle = *dev_handle_ptr;
326351

327352
uint8_t rx_buffer[2];
328353

@@ -342,7 +367,12 @@ uint16_t SCCB_Read_Addr16_Val16(uint8_t slv_addr, uint16_t reg)
342367

343368
int SCCB_Write_Addr16_Val16(uint8_t slv_addr, uint16_t reg, uint16_t data)
344369
{
345-
i2c_master_dev_handle_t dev_handle = *(get_handle_from_address(slv_addr));
370+
i2c_master_dev_handle_t *dev_handle_ptr = get_handle_from_address(slv_addr);
371+
if (dev_handle_ptr == NULL)
372+
{
373+
return -1;
374+
}
375+
i2c_master_dev_handle_t dev_handle = *dev_handle_ptr;
346376

347377
uint8_t tx_buffer[4];
348378
tx_buffer[0] = reg >> 8;

0 commit comments

Comments
 (0)