SDMMC - [STM32CubeL4][1.13.0][stm32l4xx_hal_sd] Invalid pointer address dereferencing

phlf · ‎2018-12-03

In the file stm32l4_hal_sd.c in functions:

HAL_SD_WriteBlocks
HAL_SD_ReadBlocks

No check is performed on tempbuff's bounds: its value must not exceeds pData base address + pData size but tempbuff gets incremented indefinitely until a hardfault is triggered by dereferencing reserved address space.

Fix: enclose the block where tempbuff is incremented with the following condition:

if( (tempbuff - pData) < (NumberOfBlocks * BLOCKSIZE))

Amel NASRI · ‎2020-03-25

Hello @phlf ,

Please note that the fix was deployed in STM32CubeL4 V1.14 (current one is 1.15.1).

-Amel

To give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.

View solution in original post

Amel NASRI · ‎2019-01-23

Hi @phlf ,

We recognize this issue for HAL_SD_WriteBlocks and HAL_MMC_WriteBlocks, but I am not sure that it is applicable for HAL_SD_ReadBlocks.

There is already a planning to fix it.

-Amel

To give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.

phlf · ‎2019-05-13

** DELETED **

Amel NASRI · ‎2020-03-25

Hello @phlf ,

Please note that the fix was deployed in STM32CubeL4 V1.14 (current one is 1.15.1).

-Amel

To give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.