Skip to content

Commit 63f1e40

Browse files
Fix RAM corruption caused by our hook of register_chipv6_phy(init_data*).
"init_data", when non-NULL, is on the heap, and the register_chipv6_phy call sometimes modifies data in (at least) the offset range [128:249], suggesting that it is a buffer larger than 128 bytes in size (the size of our "phy_init_data" buffer). When we use our static buffer (prior to this change), the call could would overwrite the .rodata section and lead to undefined behaviour. To address this, just patch the heap-allocated buffer with our data. Move phy_init_data to flash as it's now readonly and never modified.
1 parent bb2d1ae commit 63f1e40

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

cores/esp8266/core_esp8266_phy.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,9 @@
2424
#include <stddef.h>
2525
#include <stdbool.h>
2626

27-
static uint8_t phy_init_data[128] =
27+
#include "c_types.h"
28+
29+
static const uint8_t ICACHE_FLASH_ATTR phy_init_data[128] =
2830
{
2931
[0] = 5, // Reserved, do not change
3032
[1] = 0, // Reserved, do not change
@@ -241,9 +243,12 @@ static uint8_t phy_init_data[128] =
241243
};
242244

243245
extern int __real_register_chipv6_phy(uint8_t* init_data);
244-
extern int __wrap_register_chipv6_phy(uint8_t* unused) {
245-
phy_init_data[107] = __get_adc_mode();
246-
return __real_register_chipv6_phy(phy_init_data);
246+
extern int __wrap_register_chipv6_phy(uint8_t* init_data) {
247+
if (init_data != NULL) {
248+
memcpy(init_data, phy_init_data, sizeof(phy_init_data));
249+
init_data[107] = __get_adc_mode();
250+
}
251+
return __real_register_chipv6_phy(init_data);
247252
}
248253

249254
extern int __get_rf_mode(void) __attribute__((weak));

0 commit comments

Comments
 (0)