SDMMC - [STM32CubeL4][1.13.0][stm32l4xx_hal_sd] Invalid pointer address dereferencing

[phlf]

In the file stm32l4_hal_sd.c in functions:

• HAL_SD_WriteBlocks
• HAL_SD_ReadBlocks

No check is performed on tempbuff's bounds: its value must not exceeds pData base address + pData size but tempbuff gets incremented indefinitely until a hardfault is triggered by dereferencing reserved address space.

Fix: enclose the block where tempbuff is incremented with the following condition:

if( (tempbuff - pData) < (NumberOfBlocks * BLOCKSIZE))

[Amel NASRI]

Hi @phlf​ ,

We recognize this issue for HAL_SD_WriteBlocks and HAL_MMC_WriteBlocks, but I am not sure that it is applicable for HAL_SD_ReadBlocks.

There is already a planning to fix it.

-Amel

[phlf]

** DELETED **

[Amel NASRI]

Hello @phlf​ ,

Please note that the fix was deployed in STM32CubeL4 V1.14 (current one is 1.15.1).

-Amel