From b0cd97085c23665dc588035c0ce42dd32c02aa32 Mon Sep 17 00:00:00 2001 From: Chase Valentine Date: Tue, 10 Mar 2026 04:15:44 -0500 Subject: [PATCH] usb_uram: fix SPI array out-of-bounds indexing Use SPIEXT_LSOP_GET_BUS() to extract bus index before accessing spi_core[] and spi_int_number[], matching the PCIe implementation. Co-Authored-By: Claude Opus 4.6 --- src/lib/lowlevel/usb_uram/usb_uram_generic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/lib/lowlevel/usb_uram/usb_uram_generic.c b/src/lib/lowlevel/usb_uram/usb_uram_generic.c index 870d0dc6..0e0fff59 100644 --- a/src/lib/lowlevel/usb_uram/usb_uram_generic.c +++ b/src/lib/lowlevel/usb_uram/usb_uram_generic.c @@ -166,13 +166,13 @@ int usb_uram_ls_op(lldev_t dev, subdev_t subdev, if (SPIEXT_LSOP_GET_BUS(ls_op_addr) >= pdb->spi_count) return -EINVAL; - if (pdb->spi_core[ls_op_addr] == SPI_CORE_32W) { + if (pdb->spi_core[SPIEXT_LSOP_GET_BUS(ls_op_addr)] == SPI_CORE_32W) { if (((meminsz != 4) && (meminsz != 0)) || (memoutsz != 4)) return -EINVAL; res = usb_uram_reg_out(dev, pdb->spi_base[SPIEXT_LSOP_GET_BUS(ls_op_addr)], *(const uint32_t*)pout); - } else if (pdb->spi_core[ls_op_addr] == SPI_CORE_CFGW_CS8) { + } else if (pdb->spi_core[SPIEXT_LSOP_GET_BUS(ls_op_addr)] == SPI_CORE_CFGW_CS8) { uint32_t spi_tr[2] = { SPIEXT_LSOP_GET_CFG(ls_op_addr), spiext_make_data_reg(memoutsz, pout) @@ -265,8 +265,8 @@ int usb_uram_read_wait(lldev_t dev, unsigned lsop, lsopaddr_t ls_op_addr, size_t switch(lsop) { case USDR_LSOP_SPI: - int_number = gen->spi_int_number[ls_op_addr]; - reg = gen->db.spi_core[ls_op_addr]; + int_number = gen->spi_int_number[SPIEXT_LSOP_GET_BUS(ls_op_addr)]; + reg = gen->db.spi_core[SPIEXT_LSOP_GET_BUS(ls_op_addr)]; strcpy(busname, "SPI"); break; case USDR_LSOP_I2C_DEV: