From 9d3926a25ab60beccdc6768e6f0f418e11e86499 Mon Sep 17 00:00:00 2001 From: robert Date: Thu, 2 Jul 2026 12:22:39 +0300 Subject: [PATCH] Improve OTA boundary handling --- mongoose.c | 5 ++++- src/flash.c | 3 +++ src/http.c | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/mongoose.c b/mongoose.c index 383e3faf..32b7ad97 100644 --- a/mongoose.c +++ b/mongoose.c @@ -2318,6 +2318,9 @@ bool mg_ota_flash_write(const void *buf, size_t len, struct mg_flash *flash) { bool ok = false; if (s_size == 0) { MG_ERROR(("OTA is not started, call mg_ota_begin()")); + } else if (s_addr + MG_ROUND_UP(len, flash->align) > + (char *) flash->start + flash->size) { + MG_ERROR(("Flash overflow: attempting to write past the flash boundary")); } else { size_t len_aligned_down = MG_ROUND_DOWN(len, flash->align); if (len_aligned_down) ok = flash->write_fn(s_addr, buf, len_aligned_down); @@ -4298,7 +4301,7 @@ static void mg_upload_handler(struct mg_connection *c, int ev, void *ev_data) { size_t alignment = 512; size_t left = p->expected > p->received ? p->expected - p->received : 0; size_t aligned = c->recv.len < left ? MG_ROUND_DOWN(c->recv.len, alignment) - : c->recv.len; + : left; bool ok = true; if (aligned > 0) { if (p->fd != NULL) { diff --git a/src/flash.c b/src/flash.c index 627f14df..758f8552 100644 --- a/src/flash.c +++ b/src/flash.c @@ -37,6 +37,9 @@ bool mg_ota_flash_write(const void *buf, size_t len, struct mg_flash *flash) { bool ok = false; if (s_size == 0) { MG_ERROR(("OTA is not started, call mg_ota_begin()")); + } else if (s_addr + MG_ROUND_UP(len, flash->align) > + (char *) flash->start + flash->size) { + MG_ERROR(("Flash overflow: attempting to write past the flash boundary")); } else { size_t len_aligned_down = MG_ROUND_DOWN(len, flash->align); if (len_aligned_down) ok = flash->write_fn(s_addr, buf, len_aligned_down); diff --git a/src/http.c b/src/http.c index bfaea27a..d5e73274 100644 --- a/src/http.c +++ b/src/http.c @@ -1030,7 +1030,7 @@ static void mg_upload_handler(struct mg_connection *c, int ev, void *ev_data) { size_t alignment = 512; size_t left = p->expected > p->received ? p->expected - p->received : 0; size_t aligned = c->recv.len < left ? MG_ROUND_DOWN(c->recv.len, alignment) - : c->recv.len; + : left; bool ok = true; if (aligned > 0) { if (p->fd != NULL) {