diff --git a/components/bootloader_support/src/bootloader_utility.c b/components/bootloader_support/src/bootloader_utility.c index 9da668af3e..11d57ee1f0 100644 --- a/components/bootloader_support/src/bootloader_utility.c +++ b/components/bootloader_support/src/bootloader_utility.c @@ -1234,7 +1234,16 @@ esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, while (len > 0) { uint32_t mmu_page_offset = ((flash_offset & MMAP_ALIGNED_MASK) != 0) ? 1 : 0; /* Skip 1st MMU Page if it is already populated */ - uint32_t partial_image_len = MIN(len, ((mmu_free_pages_count - mmu_page_offset) * SPI_FLASH_MMU_PAGE_SIZE)); /* Read the image that fits in the free MMU pages */ + uint32_t max_pages = (mmu_free_pages_count > mmu_page_offset) ? (mmu_free_pages_count - mmu_page_offset) : 0; + if (max_pages == 0) { + ESP_LOGE(TAG, "No free MMU pages are available"); + return ESP_ERR_NO_MEM; + } + uint32_t max_image_len; + if (__builtin_mul_overflow(max_pages, SPI_FLASH_MMU_PAGE_SIZE, &max_image_len)) { + max_image_len = UINT32_MAX; + } + uint32_t partial_image_len = MIN(len, max_image_len); /* Read the image that fits in the free MMU pages */ const void * image = bootloader_mmap(flash_offset, partial_image_len); if (image == NULL) {