Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Overflow possible from bad usb msg #5

Open
schneidersoft opened this issue Aug 6, 2023 · 1 comment
Open

Overflow possible from bad usb msg #5

schneidersoft opened this issue Aug 6, 2023 · 1 comment

Comments

@schneidersoft
Copy link

https://github.com/stefaandesmet2003/stlinkswim/blob/80e039d1fadfcaa6bac2437eb2b26763f74b312e/src/main.c#L359C61-L359C61

      // we already received STLINK_SWIM_WRITEMEM, but expect more bytes to write
      memcpy(swimBuffer+stlinkStatus.curBytes,epBuffer,len);

It is possible to cause a buffer overflow simply by sending a write command followed by more data, where the data is more than SWIM_BUFFERSIZE

@stefaandesmet2003
Copy link
Owner

stm8flash and openocd respect the SWIM_BUFFERSIZE from the original stlink
this repo is proof of concept code - feel free to improve
you could try to figure out how stlink responds when more than SWIM_BUFFERSIZE bytes are sent, and implement the same behaviour here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants