This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch releases/13.0
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/releases/13.0 by this push:
new 0076f354018 drivers/eeprom/i2c_xx24xx: Integer Overflow in I2C EEPROM
ee24xx_seek()
0076f354018 is described below
commit 0076f354018a8bc4288b17bc8774a8ff1d1b8e76
Author: Catalin Visinescu <[email protected]>
AuthorDate: Wed Jun 17 17:33:10 2026 -0400
drivers/eeprom/i2c_xx24xx: Integer Overflow in I2C EEPROM ee24xx_seek()
The function seek which allows the user to move the cursor to a particular
offset in order to read and write from EEPROM storage does not validate the
offset is valid. Later, this can cause an out-of-bounds reads or writes.
Note that newpos may store a large value, larger than the size of the
EEPROM.
Similar change in the SPI driver.
Tested locally, builds fine.
Signed-off-by: Catalin Visinescu <[email protected]>
---
drivers/eeprom/i2c_xx24xx.c | 17 ++++++++++++++++-
drivers/eeprom/spi_xx25xx.c | 17 ++++++++++++++++-
2 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/drivers/eeprom/i2c_xx24xx.c b/drivers/eeprom/i2c_xx24xx.c
index 9cdaab9c0ca..fe9ef045a2f 100644
--- a/drivers/eeprom/i2c_xx24xx.c
+++ b/drivers/eeprom/i2c_xx24xx.c
@@ -570,20 +570,35 @@ static off_t ee24xx_seek(FAR struct file *filep, off_t
offset, int whence)
return ret;
}
- /* Determine the new, requested file position */
+ /* Determine the new, requested file position
+ * For EEPROM sparse files are not allowed.
+ * "offset" can be negative, "newpos" must be between 0 and eedev->size
+ */
switch (whence)
{
case SEEK_CUR:
newpos = filep->f_pos + offset;
+ if (newpos < 0 || newpos > eedev->size)
+ {
+ return -EINVAL;
+ }
break;
case SEEK_SET:
newpos = offset;
+ if (newpos < 0 || newpos > eedev->size)
+ {
+ return -EINVAL;
+ }
break;
case SEEK_END:
newpos = eedev->size + offset;
+ if (newpos < 0 || newpos > eedev->size)
+ {
+ return -EINVAL;
+ }
break;
default:
diff --git a/drivers/eeprom/spi_xx25xx.c b/drivers/eeprom/spi_xx25xx.c
index 4076c186e86..f4bb68dd915 100644
--- a/drivers/eeprom/spi_xx25xx.c
+++ b/drivers/eeprom/spi_xx25xx.c
@@ -929,20 +929,35 @@ static off_t ee25xx_seek(FAR struct file *filep, off_t
offset, int whence)
return ret;
}
- /* Determine the new, requested file position */
+ /* Determine the new, requested file position
+ * For EEPROM sparse files are not allowed.
+ * "offset" can be negative, "newpos" must be between 0 and eedev->size
+ */
switch (whence)
{
case SEEK_CUR:
newpos = filep->f_pos + offset;
+ if (newpos < 0 || newpos > eedev->size)
+ {
+ return -EINVAL;
+ }
break;
case SEEK_SET:
newpos = offset;
+ if (newpos < 0 || newpos > eedev->size)
+ {
+ return -EINVAL;
+ }
break;
case SEEK_END:
newpos = eedev->size + offset;
+ if (newpos < 0 || newpos > eedev->size)
+ {
+ return -EINVAL;
+ }
break;
default:
