The loop wrote the 5-byte 'pBOOT' trailer SWAP_SIZE times, emitting
5x SWAP_SIZE bytes past the 4KB swap region (the file grew 16KB past
the mmap'd device) and leaving the swap filled with 'pBOOT' instead
of the erased 0xFF state real flash has. Use the 0xFF pad loop the
non-WOLF path already uses.
Shifting a uint8_t (int-promoted) left by 24 is undefined behaviour per C11
6.5.7p4 when the byte value is >= 0x80. Cast the MSB operand to uint32_t at
both sites (CMD_APP_VER line 391, CMD_HDR_VER line 412).
Note: the report's endian-mismatch claim is incorrect. CMD_APP_VER senders
(app_nrf52.c, app_stm32f4.c, app_stm32wb.c) all transmit version bytes
MSB-first; CMD_HDR_VER is sent LSB-first by uart_send_current_version. The
two decode expressions are intentionally asymmetric and both reconstruct the
correct version value.
uart_flash_erase/read/write read attacker-controlled address and len as raw
4-byte words from the UART peer and guard the mmap region with
`address + len > FIRMWARE_PARTITION_SIZE + SWAP_SIZE`. The addition is done in
uint32_t, so a large len (e.g. 0xFFFFFFFF) wraps the sum below 0x21000 and the
guard passes, after which the loop walks far past the 0x21000-byte mapping —
SIGSEGV on a 64-bit host, or wrapped writes over the firmware header on 32-bit.
Compute address + len in uint64_t before the comparison so the sum cannot wrap.
Add a pty-driven regression test (test_overflow) and a `make test` target that
sends an ERASE with a wrapping address+len and asserts the server survives.
* Added simulator support for Mac.
* Fix for simulator to properly assemble wolfboot.bin + signedtestapp + update + swap.
* Fixes for handling 64-bit assigned mmap virtual addresses. Added hal_flash_write and hal_flash_erase support for 64-bit address using uintptr_t. Enabled if platform is 64-bit and `FORCE_32BIT` is not defined
* Fix simulator conflict with src/libwolfboot.o object in test-app.
* Cleanup test-app linker flags.
Daniele Lacamera
gojimmypi
Daniele Lacamera
David Garske