Merge branch 'patch-3' into 'master'

Dzarda7 · Dzarda7 · commit c78721d654c4 · 2025-10-07T02:46:44.000+08:00
fix: Correct flash boundary check for read/verify operations

Closes ESF-246, ESF-247, and ESF-248

See merge request espressif/esp-serial-flasher!168
diff --git a/src/esp_loader.c b/src/esp_loader.c
@@ -609,7 +609,7 @@ static esp_loader_error_t flash_read_stub(uint8_t *dest, uint32_t address, uint3
 esp_loader_error_t esp_loader_flash_read(uint8_t *dest, uint32_t address, uint32_t length)
 {
     RETURN_ON_ERROR(init_flash_params());
-    if (address + length >= s_target_flash_size) {
+    if (address + length > s_target_flash_size) {
         return ESP_LOADER_ERROR_IMAGE_SIZE;
     }
 
@@ -810,7 +810,7 @@ esp_loader_error_t esp_loader_flash_verify_known_md5(uint32_t address,
 
     RETURN_ON_ERROR(init_flash_params());
 
-    if (address + size >= s_target_flash_size) {
+    if (address + size > s_target_flash_size) {
         return ESP_LOADER_ERROR_IMAGE_SIZE;
     }
 

Original file line number	Diff line number	Diff line change
`@@ -609,7 +609,7 @@ static esp_loader_error_t flash_read_stub(uint8_t *dest, uint32_t address, uint3`
`609`	`609`	`esp_loader_error_t esp_loader_flash_read(uint8_t *dest, uint32_t address, uint32_t length)`
`610`	`610`	`{`
`611`	`611`	`RETURN_ON_ERROR(init_flash_params());`
`612`		`- if (address + length >= s_target_flash_size) {`
	`612`	`+ if (address + length > s_target_flash_size) {`
`613`	`613`	`return ESP_LOADER_ERROR_IMAGE_SIZE;`
`614`	`614`	`}`
`615`	`615`
`@@ -810,7 +810,7 @@ esp_loader_error_t esp_loader_flash_verify_known_md5(uint32_t address,`
`810`	`810`
`811`	`811`	`RETURN_ON_ERROR(init_flash_params());`
`812`	`812`
`813`		`- if (address + size >= s_target_flash_size) {`
	`813`	`+ if (address + size > s_target_flash_size) {`
`814`	`814`	`return ESP_LOADER_ERROR_IMAGE_SIZE;`
`815`	`815`	`}`
`816`	`816`