From e3ec652e843ede54620803cd07856c4755f2e401 Mon Sep 17 00:00:00 2001
From: Mark Atwood <mark@wolfssl.com>
Date: Thu, 9 Jul 2026 16:31:00 -0700
Subject: [PATCH] fix: guard flash offset+size overflow

---
 port/posix/posix_flash_file.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/port/posix/posix_flash_file.c b/port/posix/posix_flash_file.c
index 9c067389f..459876747 100644
--- a/port/posix/posix_flash_file.c
+++ b/port/posix/posix_flash_file.c
@@ -179,7 +179,8 @@ int posixFlashFile_Read(   void* c,
 {
     posixFlashFileContext* context = c;
     if (    (context == NULL) ||
-            (offset + size > MAX_OFFSET(context))){
+            (offset > MAX_OFFSET(context)) ||
+            (size > MAX_OFFSET(context) - offset)){
         return WH_ERROR_BADARGS;
     }
 
@@ -205,7 +206,8 @@ int posixFlashFile_Program(void* c,
 {
     posixFlashFileContext* context = c;
     if (    (context == NULL) ||
-            (offset + size > MAX_OFFSET(context))){
+            (offset > MAX_OFFSET(context)) ||
+            (size > MAX_OFFSET(context) - offset)){
         return WH_ERROR_BADARGS;
     }
 
@@ -242,7 +244,8 @@ int posixFlashFile_Verify( void* c,
     uint32_t data_offset = 0;
 
     if (    (context == NULL) ||
-            (offset + size > MAX_OFFSET(context))){
+            (offset > MAX_OFFSET(context)) ||
+            (size > MAX_OFFSET(context) - offset)){
         return WH_ERROR_BADARGS;
     }
 
@@ -278,7 +281,8 @@ int posixFlashFile_Erase(void* c,
 {
     posixFlashFileContext* context = c;
     if (    (context == NULL) ||
-            (offset + size > MAX_OFFSET(context))){
+            (offset > MAX_OFFSET(context)) ||
+            (size > MAX_OFFSET(context) - offset)){
         return WH_ERROR_BADARGS;
     }
 
@@ -314,7 +318,8 @@ int posixFlashFile_BlankCheck(void* c,
     uint32_t this_size = 0;
 
     if (    (context == NULL) ||
-            (offset + size > MAX_OFFSET(context))){
+            (offset > MAX_OFFSET(context)) ||
+            (size > MAX_OFFSET(context) - offset)){
         return WH_ERROR_BADARGS;
     }