bugfix (nvs): Fixed issues found by Coverity

*  Fixed potential memory leak
*  Fixed wrong strncpy usage
*  Fixed potential out of bounds access
This commit is contained in:
Jakob Hasse
2021-12-01 12:16:49 +08:00
parent 0ac6a105ef
commit 4c8c2a8079
4 changed files with 32 additions and 52 deletions
+12 -15
View File
@@ -1,16 +1,8 @@
// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/*
* SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include "nvs_page.hpp"
#include <esp_rom_crc.h>
#include <cstdio>
@@ -200,6 +192,10 @@ esp_err_t Page::writeItem(uint8_t nsIndex, ItemType datatype, const char* key, c
return ESP_ERR_NVS_VALUE_TOO_LONG;
}
if ((!isVariableLengthType(datatype)) && dataSize > 8) {
return ESP_ERR_INVALID_ARG;
}
size_t totalSize = ENTRY_SIZE;
size_t entriesCount = 1;
if (isVariableLengthType(datatype)) {
@@ -244,7 +240,8 @@ esp_err_t Page::writeItem(uint8_t nsIndex, ItemType datatype, const char* key, c
return err;
}
size_t left = dataSize / ENTRY_SIZE * ENTRY_SIZE;
size_t rest = dataSize % ENTRY_SIZE;
size_t left = dataSize - rest;
if (left > 0) {
err = writeEntryData(static_cast<const uint8_t*>(data), left);
if (err != ESP_OK) {
@@ -252,7 +249,7 @@ esp_err_t Page::writeItem(uint8_t nsIndex, ItemType datatype, const char* key, c
}
}
size_t tail = dataSize - left;
size_t tail = rest;
if (tail > 0) {
std::fill_n(item.rawData, ENTRY_SIZE, 0xff);
memcpy(item.rawData, static_cast<const uint8_t*>(data) + left, tail);