This is an automated email from the ASF dual-hosted git repository.
jerzy pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-core.git
The following commit(s) were added to refs/heads/master by this push:
new 6177f10f6 stm32: Fix flash write
6177f10f6 is described below
commit 6177f10f67ca96ef52678796c08f298d98359a7a
Author: Jerzy Kasenberg <[email protected]>
AuthorDate: Tue Jun 25 15:13:02 2024 +0200
stm32: Fix flash write
Code could corrupt stack when writing to flash that
requires write of size greater then 1.
memset function used for filling buffer so writes have correct
number of bytes incorrectly cast buffer to (uint32_t *) and
then added number of bytes resulting in possible write to
unintended stack memory.
Signed-off-by: Jerzy Kasenberg <[email protected]>
---
hw/mcu/stm/stm32_common/src/hal_flash.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/mcu/stm/stm32_common/src/hal_flash.c
b/hw/mcu/stm/stm32_common/src/hal_flash.c
index d4f04ac51..7acf028f2 100644
--- a/hw/mcu/stm/stm32_common/src/hal_flash.c
+++ b/hw/mcu/stm/stm32_common/src/hal_flash.c
@@ -120,7 +120,7 @@ stm32_flash_write_linear(const struct hal_flash *dev,
uint32_t address,
for (i = 0; i < num_words; i++) {
if (num_bytes < align) {
memcpy(&val, &((uint8_t *)src)[i * align], num_bytes);
- memset((uint32_t *)&val + num_bytes, dev->hf_erased_val, align -
num_bytes);
+ memset((uint8_t *)&val + num_bytes, dev->hf_erased_val, align -
num_bytes);
} else {
memcpy(&val, &((uint8_t *)src)[i * align], align);
}
