ota: add missing jumps to cleanup code
What the developer wrote
Authored by Jon Griffiths
ota: add missing jumps to cleanup code
What changed, and why it matters
This commit fixes three places in the firmware update (OTA) code where an error was recorded but the code kept running instead of jumping to cleanup. After an update error, the device could continue to process messages and potentially finalize or report a successful update when it should have aborted. This is a logic bug in error handling that could lead to a corrupted or incomplete firmware being accepted.
Treat as a security-relevant bug fix. Review whether the fall-through behavior was reachable from an attacker-controlled update payload and whether any downstream state could lead to a successful update status being reported. Consider adding static analysis or tests to ensure all error paths in OTA handlers terminate at cleanup.
Security signals we found
Missing error-path termination in firmware update handler
Error status set but control flow continues
OTA integrity check failure not immediately fatal
Firmware size mismatch not immediately fatal
Evidence from the diff
In ota.c and ota_delta.c, error conditions set joctx->ota_return_status to an error code but previously fell through to subsequent code. The patch adds ‘goto cleanup;’ so control flow exits the update process immediately. Without these jumps, after a size mismatch or decompression/patch failure the code would continue to the ‘complete/request for status’ handling and could return success or perform further operations on a failed update context.
Changed components
main/process/ota.cmain/process/ota_delta.cFirmware Over-The-Air (OTA) update processInspect captured patch +3 / −0
diff --git a/main/process/ota.c b/main/process/ota.c
index eda789e..98b340c 100644
--- a/main/process/ota.c
+++ b/main/process/ota.c
@@ -110,10 +110,12 @@ void ota_process(void* process_ptr)
JADE_LOGE("Expected uncompressed size: %u, got %u", joctx->firmwaresize,
joctx->firmwaresize - joctx->remaining_uncompressed);
joctx->ota_return_status = OTA_ERR_DECOMPRESS;
+ goto cleanup;
}
if (joctx->fwwritten != joctx->firmwaresize) {
JADE_LOGE("Expected amountof firmware written: %u, expected %u", joctx->fwwritten, joctx->firmwaresize);
joctx->ota_return_status = OTA_ERR_DECOMPRESS;
+ goto cleanup;
}
// Expect a complete/request for status
diff --git a/main/process/ota_delta.c b/main/process/ota_delta.c
index 9a635e9..2719727 100644
--- a/main/process/ota_delta.c
+++ b/main/process/ota_delta.c
@@ -189,6 +189,7 @@ void ota_delta_process(void* process_ptr)
if (joctx->fwwritten != joctx->firmwaresize) {
joctx->ota_return_status = OTA_ERR_PATCH;
+ goto cleanup;
}
// Expect a complete/request for status
Why this scored 61/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.