Fix SDHCI response bit span check

F/1471

Author: danielinux

src/sdhci.c

@@ -565,7 +565,7 @@ static uint32_t sdhci_get_response_bits(int from, int count)
     resp[3] = SDHCI_REG(SDHCI_SRS07);
 
     ret = resp[off] >> shft;
-    if ((from + shft) > 32) {
+    if ((shft + count) > 32) {
         ret |= resp[off + 1] << ((32 - shft) % 32);
     }
     return ret & mask;

tools/unit-tests/Makefile

@@ -49,7 +49,7 @@ TESTS:=unit-parser unit-extflash unit-string unit-spi-flash unit-aes128 \
        unit-update-flash-enc unit-update-ram unit-pkcs11_store unit-psa_store unit-disk \
        unit-update-disk unit-multiboot unit-boot-x86-fsp unit-qspi-flash unit-tpm-rsa-exp \
        unit-image-nopart unit-image-sha384 unit-image-sha3-384 unit-store-sbrk \
-       unit-tpm-blob unit-policy-sign
+       unit-tpm-blob unit-policy-sign unit-sdhci-response-bits
 
 all: $(TESTS)
 
@@ -145,6 +145,10 @@ unit-store-sbrk: unit-store-sbrk.c ../../src/store_sbrk.c
 unit-string: ../../include/target.h unit-string.c
 	gcc -o $@ $^ $(CFLAGS) -DDEBUG_UART -DPRINTF_ENABLED $(LDFLAGS)
 
+unit-sdhci-response-bits: ../../include/target.h unit-sdhci-response-bits.c
+	gcc -o $@ $^ $(CFLAGS) -ffunction-sections -fdata-sections $(LDFLAGS) \
+		-Wl,--gc-sections
+
 unit-aes128: ../../include/target.h unit-extflash.c
 	gcc -o $@ $^ $(CFLAGS) $(LDFLAGS)
 

tools/unit-tests/unit-sdhci-response-bits.c

@@ -0,0 +1,101 @@
+/* unit-sdhci-response-bits.c
+ *
+ * Unit tests for sdhci response bit extraction.
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfBoot.
+ *
+ * wolfBoot is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfBoot is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#define DISK_SDCARD 1
+
+#include <check.h>
+#include <stdint.h>
+#include <string.h>
+
+static uint32_t mock_regs[0x260 / sizeof(uint32_t)];
+
+uint64_t hal_get_timer_us(void)
+{
+    return 0;
+}
+
+uint32_t sdhci_reg_read(uint32_t offset)
+{
+    return mock_regs[offset / sizeof(uint32_t)];
+}
+
+void sdhci_reg_write(uint32_t offset, uint32_t val)
+{
+    mock_regs[offset / sizeof(uint32_t)] = val;
+}
+
+void sdhci_platform_init(void)
+{
+}
+
+void sdhci_platform_irq_init(void)
+{
+}
+
+void sdhci_platform_set_bus_mode(int is_emmc)
+{
+    (void)is_emmc;
+}
+
+#include "../../src/sdhci.c"
+
+static void set_response(uint32_t r0, uint32_t r1, uint32_t r2, uint32_t r3)
+{
+    memset(mock_regs, 0, sizeof(mock_regs));
+    mock_regs[SDHCI_SRS04 / sizeof(uint32_t)] = r0;
+    mock_regs[SDHCI_SRS05 / sizeof(uint32_t)] = r1;
+    mock_regs[SDHCI_SRS06 / sizeof(uint32_t)] = r2;
+    mock_regs[SDHCI_SRS07 / sizeof(uint32_t)] = r3;
+}
+
+START_TEST(test_csd_struct_does_not_cross_registers)
+{
+    set_response(0, 0, 0, 2U << 22);
+
+    ck_assert_uint_eq(sdhci_get_response_bits(126, 2), 2);
+}
+END_TEST
+
+Suite *sdhci_suite(void)
+{
+    Suite *s = suite_create("sdhci");
+    TCase *tc = tcase_create("response_bits");
+
+    tcase_add_test(tc, test_csd_struct_does_not_cross_registers);
+    suite_add_tcase(s, tc);
+
+    return s;
+}
+
+int main(void)
+{
+    int fails;
+    Suite *s = sdhci_suite();
+    SRunner *sr = srunner_create(s);
+
+    srunner_run_all(sr, CK_NORMAL);
+    fails = srunner_ntests_failed(sr);
+    srunner_free(sr);
+
+    return fails;
+}