[OpenOCD-commit] Main OpenOCD repository branch, master, updated. v0.12.0-1681-g1f3f5831d

[openocd-gerrit <ope...@us...>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Main OpenOCD repository".

The branch, master has been updated
       via  1f3f5831d25f58dbeed8de4ad6627c75e774bd2c (commit)
      from  54a33aeab039b7eaad7a9ee5856ed2235800e0b1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1f3f5831d25f58dbeed8de4ad6627c75e774bd2c
Author: Tomas Vanek <va...@fb...>
Date:   Fri Aug 21 09:54:15 2026 +0200

    jtag/drivers/cmsis_dap: fix possible buffer overflow
    
    The adapter response of CMD_SWO_Data command relied on well behaved
    adapter firmware. In case of malicious modification of adapter firmware
    or accidentally getting the response of another CMSIS-DAP command,
    cmsis_dap_cmd_dap_swo_data() could copy more data than max_trace_count.
    
    Limit the returned trace_data with max_trace_count.
    Also check if trace_count (trace data size) fits into the adapter response.
    
    Change-Id: Iea6e5910ee17f2b3635c7fc67c4eaa8add5d1b4e
    Signed-off-by: Tomas Vanek <va...@fb...>
    Reviewed-on: https://review.openocd.org/c/openocd/+/9856
    Tested-by: jenkins
    Reviewed-by: Antonio Borneo <bor...@gm...>

diff --git a/src/jtag/drivers/cmsis_dap.c b/src/jtag/drivers/cmsis_dap.c
index fda8d68e5..bb8a25262 100644
--- a/src/jtag/drivers/cmsis_dap.c
+++ b/src/jtag/drivers/cmsis_dap.c
@@ -785,11 +785,23 @@ static int cmsis_dap_cmd_dap_swo_data(
 		return ERROR_JTAG_DEVICE_ERROR;
 	}
 
+	size_t count = le_to_h_u16(&cmsis_dap_handle->response[2]);
+	if (count > max_trace_count) {
+		LOG_WARNING("CMSIS-DAP: CMD_SWO_Data returned more %zu than requested %zu",
+					count, max_trace_count);
+		count = max_trace_count;
+	}
+	if (4 + count > cmsis_dap_handle->response_size) {
+		LOG_ERROR("CMSIS-DAP: CMD_SWO_Data payload (size %zu) does not fit into response (size %u)",
+				  count, cmsis_dap_handle->response_size);
+		return ERROR_JTAG_DEVICE_ERROR;
+	}
+
 	*trace_status = cmsis_dap_handle->response[1];
-	*trace_count = le_to_h_u16(&cmsis_dap_handle->response[2]);
+	*trace_count = count;
 
-	if (*trace_count > 0)
-		memcpy(data, &cmsis_dap_handle->response[4], *trace_count);
+	if (count > 0)
+		memcpy(data, &cmsis_dap_handle->response[4], count);
 
 	return ERROR_OK;
 }

-----------------------------------------------------------------------

Summary of changes:
 src/jtag/drivers/cmsis_dap.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
Main OpenOCD repository