From 179169268ca1bbac092324f597fbea090d75355e Mon Sep 17 00:00:00 2001 From: SydMontague Date: Fri, 2 Feb 2024 12:12:48 +0100 Subject: [PATCH] jtag/commands: fixed buffer overflow When performing a command queue allocation larger than the default page size of 1MiB any subsequent allocations will run into an integer under- flow when checking for the remaining memory left in the current page. Causing the function returning a pointer past the end of the buffer and thus creating a buffer overflow. This has been observed to cause some transfers to Efinix FPGAs to fail, because another buffer can get corrupted in the process, causing its respective free() to fail. Change-Id: Ic5a0e1774e2dbd58f1a05127f14816c8251a7d9c Signed-off-by: SydMontague Reviewed-on: https://review.openocd.org/c/openocd/+/8126 Reviewed-by: Tomas Vanek Reviewed-by: Antonio Borneo Tested-by: jenkins --- src/jtag/commands.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/jtag/commands.c b/src/jtag/commands.c index c36c21923..a60684c88 100644 --- a/src/jtag/commands.c +++ b/src/jtag/commands.c @@ -103,7 +103,7 @@ void *cmd_queue_alloc(size_t size) if (*p_page) { p_page = &cmd_queue_pages_tail; - if (CMD_QUEUE_PAGE_SIZE - (*p_page)->used < size) + if (CMD_QUEUE_PAGE_SIZE < (*p_page)->used + size) p_page = &((*p_page)->next); }