Stefan Kerkmann 1983421b7d XAP: prevent OOB reads in config blob handler (#18926)
This fixes two bugs:

1. An invalid offset could be specified which wasn't checked to be in
   the bounds of the config blob.
2. The data_len check was incorrect as it would allow reading one byte
   past the config blob lenght.

Before the changes the following operation wouldn't fail:

Assuming we have blob of 64 bytes size and attempt a read with an
offset of 32 and data_len of 32, we actually try to read 32 bytes
starting from the 33. byte in the config blob. This reads exactly
one byte past array. Therefore we have to subtract one byte the get
the correct length.
2022-11-01 15:54:56 +00:00
2022-10-31 21:15:12 +00:00
2022-10-31 21:15:12 +00:00
2022-02-11 20:00:34 -08:00
2022-10-13 01:43:47 +01:00
2022-10-05 17:32:07 +01:00
2019-09-07 07:58:41 -07:00
2022-04-13 18:00:18 +10:00

THIS IS THE DEVELOP BRANCH

Warning- This is the develop branch of QMK Firmware. You may encounter broken code here. Please see Breaking Changes for more information.

Quantum Mechanical Keyboard Firmware

Current Version Discord Docs Status GitHub contributors GitHub forks

This is a keyboard firmware based on the tmk_keyboard firmware with some useful features for Atmel AVR and ARM controllers, and more specifically, the OLKB product line, the ErgoDox EZ keyboard, and the Clueboard product line.

Documentation

The docs are powered by Docsify and hosted on GitHub. They are also viewable offline; see Previewing the Documentation for more details.

You can request changes by making a fork and opening a pull request, or by clicking the "Edit this page" link at the bottom of any page.

Supported Keyboards

The project also includes community support for lots of other keyboards.

Maintainers

QMK is developed and maintained by Jack Humbert of OLKB with contributions from the community, and of course, Hasu. The OLKB product firmwares are maintained by Jack Humbert, the Ergodox EZ by ZSA Technology Labs, the Clueboard by Zach White, and the Atreus by Phil Hagelberg.

Official Website

qmk.fm is the official website of QMK, where you can find links to this page, the documentation, and the keyboards supported by QMK.

Languages
C 90.1%
C++ 6.4%
Python 1.8%
Makefile 1.2%
Linker Script 0.2%
Other 0.2%