Striso Control Firmware Buffer Overflow Vulnerability in ThreadReadButtons Function

A buffer overflow vulnerability has been identified in the Striso Control Firmware version 54c9722. The issue arises in the function ThreadReadButtons, where the thread is allocated a working area that may not be sufficient to handle the actual stack usage, potentially leading to a stack overflow.

Impact

Exploitation of this vulnerability could result in a stack overflow, which may allow for arbitrary code execution or cause a denial-of-service condition by crashing the device.

Reproduction

To reproduce this vulnerability, build the Striso Control Firmware normally, then modify the Makefile to include optimization flags that enable stack usage analysis. After rebuilding the firmware with these flags, the stack usage file will indicate that the ThreadReadButtons function requires 248 bytes of stack, exceeding the 128 bytes allocated. This discrepancy creates a potential for stack overflow.