fds pages_init can write beyond end of m_pages array

[John Chinnick]

Using SDK 12.1.0 with flash containing data from a previous version of software.

The pages_init function in fds.c does no have adequate protection to prevent writing to data beyond the end of the m_pages array. The pages index variable can be come equal to FDS_MAX_PAGES which in my case causes a buffer overrun on the swtich (page_type) case FDS_PAGE_DATA when it writes to the m_pages[page].page_type and .p_addr and .write_offset.

Please fix the initialization so that it is safe for unexpected data as this may occur in the real world with bugs that cause memory corruption or software updates may find the flash in an unexpected state.

Find attached the contents of the flash that caused the bug to be exposed. flash_memory_contents.txt

[Hung Bui]

Hi John,

We are aware of the issue if the flash is corrupted or the firmware is updated with different fds configuration. We added a bug fix in SDK v13 which is released by the end of this week. When it's released please have a look and get back if there still potential issue with the fds init.

[John Chinnick]

Unfortunately SDK V13 no longer supports the nRF51, so I am unable to test that fix. Will the fix be back ported to the V12.x SDK?

[Hung Bui]

@John: I don't think we will have any release for SDK v12. But how about copy fds (and fstorage maybe) library from SDK v13 and put it back to SDK v12 ?