wolfBoot/tools/delta
Daniele Lacamera e38296c984 F-6398: fix OOB write in bmpatch when reconstructed image grows past source size
bmpatch mmaps `base` sized to the source file (len1) then memcpy's the
reconstructed output into base+len3, which runs past the mapping once the
destination image is larger than the source (a common case for delta
updates). This causes writes into the zero-fill slack of the last mapped
page to be silently dropped (never synced to the file even after the
trailing ftruncate) or, for larger overruns, a SIGBUS. Reproduced with the
existing `delta-test` fixtures: patching 1.txt back to the (larger) 0.txt
already corrupts the tail of the output today.

Write reconstructed blocks with pwrite(fd1, ...) instead of memcpy into the
undersized mapping; regular file writes grow the file naturally instead of
faulting/silently discarding data past the mapped region. The mmap of
`base` is only used for reads, so this is a minimal, in-place-preserving
fix. Verified `make -C tools/delta delta-test` now passes both directions
(shrinking 0->1 and growing 1->0).
2026-07-02 15:18:21 +02:00
..
delta-test
…
Makefile
…
bmdiff.c F-6398: fix OOB write in bmpatch when reconstructed image grows past source size 2026-07-02 15:18:21 +02:00
test-bmdiff.c
…