From a31f30529d3411a0a4a6549c75aadd6e725e7f60 Mon Sep 17 00:00:00 2001
From: me-no-dev <hristo@espressif.com>
Date: Mon, 15 Mar 2021 10:40:50 +0200
Subject: [PATCH] fix spiTransferBytesNL() writes past end of data_out

Fixes: https://github.com/espressif/arduino-esp32/issues/4935
---
 cores/esp32/esp32-hal-spi.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/cores/esp32/esp32-hal-spi.c b/cores/esp32/esp32-hal-spi.c
index e33019ab..5f017dd6 100644
--- a/cores/esp32/esp32-hal-spi.c
+++ b/cores/esp32/esp32-hal-spi.c
@@ -914,8 +914,20 @@ void spiTransferBytesNL(spi_t * spi, const void * data_in, uint8_t * data_out, u
         spi->dev->cmd.usr = 1;
         while(spi->dev->cmd.usr);
         if(result){
-            for (int i=0; i<c_longs; i++) {
-                result[i] = spi->dev->data_buf[i];
+            if(c_len & 3){
+                for (int i=0; i<(c_longs-1); i++) {
+                    result[i] = spi->dev->data_buf[i];
+                }
+                uint32_t last_data = spi->dev->data_buf[c_longs-1];
+                uint8_t * last_out8 = &result[c_longs-1];
+                uint8_t * last_data8 = &last_data;
+                for (int i=0; i<(c_len & 3); i++) {
+                    last_out8[i] = last_data8[i];
+                }
+            } else {
+                for (int i=0; i<c_longs; i++) {
+                    result[i] = spi->dev->data_buf[i];
+                }
             }
         }
         if(data){