fix(sd): cap the size of files read into memory

sd_card_read_file() allocated whatever st_size reported, so a hostile card could make the device chase a multi-gigabyte read before anything looked at the content. Everything read this way is a descriptor, a PSBT or a mnemonic backup, all far below the 1 MB cap.

Author: odudex

components/sd_card/include/sd_card.h

@@ -28,6 +28,15 @@ esp_err_t sd_card_remount(void);
 bool sd_card_is_mounted(void);
 
 esp_err_t sd_card_write_file(const char *path, const uint8_t *data, size_t len);
+
+/* Largest file sd_card_read_file() will pull into memory. Everything read
+ * this way is a descriptor, a PSBT or a mnemonic backup; the biggest of those
+ * is a PSBT carrying a full previous transaction per input, which stays far
+ * below this. Anything larger is refused with ESP_ERR_INVALID_SIZE rather
+ * than allocated, so a hostile card cannot make the device chase a multi-
+ * gigabyte read before anything looks at the content. */
+#define SD_CARD_MAX_READ_LEN (1024u * 1024u)
+
 esp_err_t sd_card_read_file(const char *path, uint8_t **data_out,
                             size_t *len_out);
 esp_err_t sd_card_file_size(const char *path, size_t *size_out);

components/sd_card/src/sd_card.c

@@ -226,6 +226,8 @@ esp_err_t sd_card_read_file(const char *path, uint8_t **data_out,
     return ESP_ERR_NOT_FOUND;
   if (st.st_size == 0)
     return ESP_OK;
+  if (st.st_size < 0 || (uintmax_t)st.st_size > SD_CARD_MAX_READ_LEN)
+    return ESP_ERR_INVALID_SIZE;
 
   uint8_t *buffer = malloc(st.st_size);
   if (!buffer)

main/pages/load/load.c

@@ -36,7 +36,10 @@ static void load_on_file_selected(const char *full_path, const char *dir,
   esp_err_t ret = sd_card_read_file(full_path, &data, &len);
   if (ret != ESP_OK || !data || len == 0) {
     free(data);
-    dialog_show_error_timeout("Failed to read file", NULL, 0);
+    dialog_show_error_timeout(ret == ESP_ERR_INVALID_SIZE
+                                  ? "File is too large"
+                                  : "Failed to read file",
+                              NULL, 0);
     return;
   }