i2c_slave.c: fix buffer overrun on s_i2c_handle_complete() (IDFGH-13973) #14804
+5
−4
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixing a buffer overrun of i2c_slave->data_buf.
The i2c_ll_read_rxfifo function was using t->rcv_fifo_cnf (the I2C slave reading code's buffer size) as the limit for how many bytes on write on i2c_slave->data_buf.
This buffer size for i2c_slave->data_buf is generally smaller than the buffer that the I2C slave reading code has.
Description
Issue #14803 explains the problem, but TL/DR the i2c_slave_receive() workflow causes memory corruption due to a buffer overrun. And then it generally gets to a
Core 0 panic'ed (StoreProhibited). Exception was unhandled.
error on runtime.Related
Fixes #14803
Documentation used for my own test case: https://docs.espressif.com/projects/esp-idf/en/v5.3.1/esp32/api-reference/peripherals/i2c.html
Testing
Tested locally on a couple of ESP32-DevKitC-V4 boards.
Checklist
Before submitting a Pull Request, please ensure the following: