Skip to content

Commit 05decdb

Browse files
committed
sccb-ng: fix off-by-one device capacity check to prevent overflow
SCCB_Install_Device() rejected new devices only when device_count > MAX_DEVICES. When device_count == MAX_DEVICES the function still proceeded to install the device and wrote to devices[device_count], i.e. devices[MAX_DEVICES], which is one element past the end of the devices[] array (valid indices 0..MAX_DEVICES-1). This off-by-one results in a buffer overflow / write outside the designated memory area and then increments device_count to MAX_DEVICES+1. Change the guard to `device_count >= MAX_DEVICES` so we refuse installation once the array is full and prevent the out-of-bounds write/read chain.
1 parent 69737c5 commit 05decdb

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

driver/sccb-ng.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ int SCCB_Install_Device(uint8_t slv_addr)
8080
esp_err_t ret;
8181
i2c_master_bus_handle_t bus_handle;
8282

83-
if (device_count > MAX_DEVICES)
83+
if (device_count >= MAX_DEVICES)
8484
{
8585
ESP_LOGE(TAG, "cannot add more than %d devices", MAX_DEVICES);
8686
return ESP_FAIL;

0 commit comments

Comments
 (0)