From e8688854f897d317d2bb1a32675f96977874d1b8 Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Sun, 5 Jul 2026 22:01:27 +0800 Subject: [PATCH] drivers: fix CFI MTD array bounds checks Generated-by: OpenAI Codex Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- components/drivers/mtd/mtd-cfi.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/components/drivers/mtd/mtd-cfi.c b/components/drivers/mtd/mtd-cfi.c index ef93d12b801..b8b8651e2d8 100644 --- a/components/drivers/mtd/mtd-cfi.c +++ b/components/drivers/mtd/mtd-cfi.c @@ -1066,6 +1066,13 @@ static rt_err_t cfi_flash_dev_probe(struct rt_device *dev, struct cfi_flash_devi fdev->vendor = rt_le16_to_cpu(get_unaligned(&query->primary_id)); fdev->ext_addr = rt_le16_to_cpu(get_unaligned(&query->primary_address)); num_erase_regions = query->num_erase_regions; + if (num_erase_regions > RT_ARRAY_SIZE(query->erase_region_info)) + { + LOG_E("Too many %d (> %d) erase regions found", + num_erase_regions, RT_ARRAY_SIZE(query->erase_region_info)); + num_erase_regions = RT_ARRAY_SIZE(query->erase_region_info); + query->num_erase_regions = num_erase_regions; + } if (fdev->ext_addr) { @@ -1138,13 +1145,6 @@ static rt_err_t cfi_flash_dev_probe(struct rt_device *dev, struct cfi_flash_devi for (int i = 0; i < num_erase_regions; ++i) { - if (i > RT_ARRAY_SIZE(query->erase_region_info)) - { - LOG_E("Too many %d (> %d) erase regions found", - num_erase_regions, RT_ARRAY_SIZE(query->erase_region_info)); - break; - } - value = rt_le32_to_cpu(get_unaligned(&query->erase_region_info[i])); erase_region_count = (value & 0xffff) + 1; @@ -1158,7 +1158,7 @@ static rt_err_t cfi_flash_dev_probe(struct rt_device *dev, struct cfi_flash_devi break; } - if (sect_count > RT_ARRAY_SIZE(fdev->sect)) + if (sect_count >= RT_ARRAY_SIZE(fdev->sect)) { LOG_E("Too many %d (> %d) sector found", sect_count, RT_ARRAY_SIZE(fdev->sect));