From 074f36afff1c9fda86985bf3cbc7fbe5c92a0c6c Mon Sep 17 00:00:00 2001 From: michael Date: Fri, 15 Sep 2017 16:19:11 +0800 Subject: [PATCH] fix(spi_master): fix the heap corruption bug that RX DMA writes over the temporary buffer boundary. TW#15434 Closes #994. --- components/driver/spi_master.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/driver/spi_master.c b/components/driver/spi_master.c index dc073dc28..465f06899 100644 --- a/components/driver/spi_master.c +++ b/components/driver/spi_master.c @@ -620,8 +620,8 @@ esp_err_t spi_device_queue_trans(spi_device_handle_t handle, spi_transaction_t * trans_buf.buffer_to_rcv = trans_desc->rx_buffer; } if ( trans_buf.buffer_to_rcv && handle->host->dma_chan && (!esp_ptr_dma_capable( trans_buf.buffer_to_rcv ) || ((int)trans_buf.buffer_to_rcv%4!=0)) ) { - //if rxbuf in the desc not DMA-capable, malloc a new one - trans_buf.buffer_to_rcv = heap_caps_malloc((trans_desc->rxlength+7)/8, MALLOC_CAP_DMA); + //if rxbuf in the desc not DMA-capable, malloc a new one. The rx buffer need to be length of multiples of 32 bits to avoid heap corruption. + trans_buf.buffer_to_rcv = heap_caps_malloc((trans_desc->rxlength+31)/8, MALLOC_CAP_DMA); if ( trans_buf.buffer_to_rcv==NULL ) return ESP_ERR_NO_MEM; }