Shifting a uint8_t (int-promoted) left by 24 is undefined behaviour per C11
6.5.7p4 when the byte value is >= 0x80. Cast the MSB operand to uint32_t at
both sites (CMD_APP_VER line 391, CMD_HDR_VER line 412).
Note: the report's endian-mismatch claim is incorrect. CMD_APP_VER senders
(app_nrf52.c, app_stm32f4.c, app_stm32wb.c) all transmit version bytes
MSB-first; CMD_HDR_VER is sent LSB-first by uart_send_current_version. The
two decode expressions are intentionally asymmetric and both reconstruct the
correct version value.
uart_flash_erase/read/write read attacker-controlled address and len as raw
4-byte words from the UART peer and guard the mmap region with
`address + len > FIRMWARE_PARTITION_SIZE + SWAP_SIZE`. The addition is done in
uint32_t, so a large len (e.g. 0xFFFFFFFF) wraps the sum below 0x21000 and the
guard passes, after which the loop walks far past the 0x21000-byte mapping —
SIGSEGV on a 64-bit host, or wrapped writes over the firmware header on 32-bit.
Compute address + len in uint64_t before the comparison so the sum cannot wrap.
Add a pty-driven regression test (test_overflow) and a `make test` target that
sends an ERASE with a wrapping address+len and asserts the server survives.
* Added simulator support for Mac.
* Fix for simulator to properly assemble wolfboot.bin + signedtestapp + update + swap.
* Fixes for handling 64-bit assigned mmap virtual addresses. Added hal_flash_write and hal_flash_erase support for 64-bit address using uintptr_t. Enabled if platform is 64-bit and `FORCE_32BIT` is not defined
* Fix simulator conflict with src/libwolfboot.o object in test-app.
* Cleanup test-app linker flags.
Daniele Lacamera
gojimmypi
Daniele Lacamera
David Garske