buglwIP - A Lightweight TCP/IP stack - Bugs: bug #43437, Memory corruption beyound memory...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #43437: Memory corruption beyound memory pool

Submitter:  Piotr <michcior>
Submitted:  Sat 18 Oct 2014 07:12:23 PM UTC
   
 
Category:  pbufs Severity:  3 - Normal
Item Group:  Crash Error Status:  Invalid
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.1

Mon 20 Oct 2014 05:36:05 AM UTC, comment #4: 

That's why I wondered if this was from reading the code.

> So, it points to a buffer, which is reserved outside LwIP. I
> have reserved this buffer to be e.g:
> u8_t a_buffer[MEM_SIZE];


So it is your fault. Please do read the instructions around the lines where LWIP_RAM_HEAP_POINTER is checked in mem.c on how to calculate the heap size.

Simon Goldschmidt <goldsimon>
Group administrator
Sun 19 Oct 2014 04:10:56 PM UTC, comment #3: 

The default allocation is:

u8_t ram_heap[MEM_SIZE_ALIGNED + (2*SIZEOF_STRUCT_MEM) + MEM_ALIGNMENT];


so this shortage must be a problem with your port.

Ivan Delamer <idelamer>
Group Member
Sat 18 Oct 2014 09:09:55 PM UTC, comment #2: 

I saw it "in action" :)

The "ram" is set like this:
   ram = (u8_t *)LWIP_MEM_ALIGN(LWIP_RAM_HEAP_POINTER);
So, it points to a buffer, which is reserved outside LwIP. I have reserved this buffer to be e.g:

   u8_t a_buffer[MEM_SIZE];

then (lwipopts.h):
#define LWIP_RAM_HEAP_POINTER a_buffer

It is clear that code in mem_init sets "ram_end" to the end of the buffer and hence all writings to this structure corrupt variables located after the pool.

Simple workaround
   u8_t a_buffer[MEM_SIZE+8];

Fixes it.

Maybe I have missed something from the "porting" steps, that could be the case as well.

Ragards,
Piotr.

Piotr <michcior>
Sat 18 Oct 2014 08:52:12 PM UTC, comment #1: 

Have you seen that 'ram' is only a pointer to 'ram_heap'? Have you checked the size of 'ram_heap'? Have you actually seen memory corruption or is this only from reading the code???

Simon Goldschmidt <goldsimon>
Group administrator
Sat 18 Oct 2014 07:12:23 PM UTC, original submission:  

In the mem_init (mem.c) The code assigns to "ram_end" the top of the pool. Then, if the pool was declared without spare bytes, the following instructions corrupt memory, which is located just after memory pool.

  ram_end = (struct mem )(void )&ram[MEM_SIZE_ALIGNED];
  ram_end->used = 1;
  ram_end->next = MEM_SIZE_ALIGNED;
  ram_end->prev = MEM_SIZE_ALIGNED;

Piotr <michcior>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by idelamer (Posted a comment)
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by michcior (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-10-20 goldsimon StatusWorks For Me Invalid
        Open/ClosedOpen Closed
    2014-10-18 goldsimon StatusNone Works For Me

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code