Skip to content

sccb-ng: fix off-by-one device capacity check to prevent overflow #771

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

RubenKelevra
Copy link
Contributor

Description

SCCB_Install_Device() rejected new devices only when device_count > MAX_DEVICES. When device_count == MAX_DEVICES the function still proceeded to install the device and wrote to devices[device_count], i.e. devices[MAX_DEVICES], which is one element past the end of the devices[] array (valid indices 0..MAX_DEVICES-1).

This off-by-one results in a buffer overflow / write outside the designated memory area and then increments device_count to MAX_DEVICES+1.

Change the guard to device_count >= MAX_DEVICES so we refuse installation once the array is full and prevent the out-of-bounds write/read chain.

Checklist

Before submitting a Pull Request, please ensure the following:

  • 🚨 This PR does not introduce breaking changes.
  • All CI checks (GH Actions) pass.
  • Documentation is updated as needed.
  • Tests are updated or added as necessary.
  • Code is well-commented, especially in complex areas.
  • Git history is clean — commits are squashed to the minimum necessary.

SCCB_Install_Device() rejected new devices only when device_count > MAX_DEVICES.
When device_count == MAX_DEVICES the function still proceeded to install the
device and wrote to devices[device_count], i.e. devices[MAX_DEVICES], which is
one element past the end of the devices[] array (valid indices 0..MAX_DEVICES-1).

This off-by-one results in a buffer overflow / write outside the designated
memory area and then increments device_count to MAX_DEVICES+1.

Change the guard to `device_count >= MAX_DEVICES` so we refuse installation once
the array is full and prevent the out-of-bounds write/read chain.
@me-no-dev me-no-dev merged commit f0814e6 into espressif:master Jul 17, 2025
30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants