From 5737ba06c38da300e1bf79effa2ff129090ff154 Mon Sep 17 00:00:00 2001 From: Alexey Lapshin Date: Fri, 5 Jul 2024 00:45:35 +0700 Subject: [PATCH] fix(esp_hw_support): fix acessing array bellow bounds --- components/esp_hw_support/esp_clock_output.c | 22 ++++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/components/esp_hw_support/esp_clock_output.c b/components/esp_hw_support/esp_clock_output.c index 9ad86ce4cf..efc20d5254 100644 --- a/components/esp_hw_support/esp_clock_output.c +++ b/components/esp_hw_support/esp_clock_output.c @@ -55,18 +55,22 @@ static clkout_channel_handle_t* clkout_channel_alloc(soc_clkout_sig_id_t clk_sig clkout_channel_handle_t *allocated_channel = NULL; #if SOC_GPIO_CLOCKOUT_BY_IO_MUX - portENTER_CRITICAL(&s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].clkout_channel_lock); - if (!s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].is_mapped) { - s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].is_mapped = true; - allocated_channel = &s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)]; - } else if ((s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].mapped_io_bmap & BIT(gpio_num)) && - (s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].mapped_clock == clk_sig)) { - allocated_channel = &s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)]; + int32_t channel_num = IONUM_TO_CLKOUT_CHANNEL(gpio_num); + if (channel_num < 0) { + return NULL; + } + portENTER_CRITICAL(&s_clkout_handle[channel_num].clkout_channel_lock); + if (!s_clkout_handle[channel_num].is_mapped) { + s_clkout_handle[channel_num].is_mapped = true; + allocated_channel = &s_clkout_handle[channel_num]; + } else if ((s_clkout_handle[channel_num].mapped_io_bmap & BIT(gpio_num)) && + (s_clkout_handle[channel_num].mapped_clock == clk_sig)) { + allocated_channel = &s_clkout_handle[channel_num]; } if (allocated_channel != NULL) { - allocated_channel->channel_id = (clock_out_channel_t)IONUM_TO_CLKOUT_CHANNEL(gpio_num); + allocated_channel->channel_id = (clock_out_channel_t)channel_num; } - portEXIT_CRITICAL(&s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].clkout_channel_lock); + portEXIT_CRITICAL(&s_clkout_handle[channel_num].clkout_channel_lock); #elif SOC_GPIO_CLOCKOUT_BY_GPIO_MATRIX for (uint32_t channel = 0; channel < CLKOUT_CHANNEL_MAX; channel++) { portENTER_CRITICAL(&s_clkout_handle[channel].clkout_channel_lock);