[Critical] WebUSB config write trusts host chunk index/size → RAM overflow

[cursor]

Severity

Critical — memory corruption via USB vendor interface

Location

library/HOJA-LIB-RP2040 (submodule @ db14bd3)

• src/utilities/settings.c — settings_write_config_block() (~L204–283)
• Called from src/usb/webusb.c — WEBUSB_ID_WRITE_CONFIG_BLOCK (~L204–206)

Summary

settings_write_config_block() uses host-supplied write_size and write_idx with no bounds checks against block size or BLOCK_CHUNK_MAX (32) before memcpy:

uint8_t write_size = data[BLOCK_CHUNK_SIZE_IDX];
uint8_t write_idx = data[BLOCK_CHUNK_PART_IDX];
// ...
if(write) memcpy(&(write_to_ptr[BLOCK_CHUNK_MAX*write_idx]), &(data[BLOCK_CHUNK_BEGIN_IDX]), write_size);

A USB host can set e.g. write_idx=100, write_size=32 and write past live_settings into adjacent RAM.

Impact

• Runtime memory corruption / hard fault
• Corrupted settings may be persisted on save
• Reachable over WinUSB/WebUSB vendor bulk OUT (no authentication)

Suggested fix

Clamp write_size ≤ BLOCK_CHUNK_MAX, require write_idx * BLOCK_CHUNK_MAX + write_size ≤ block_size, and validate packet length covers BLOCK_CHUNK_BEGIN_IDX + write_size.

Found by

Automated code review (Cursor cloud agent)