bugAVR Downloader/UploaDEr - Bugs: bug #43471, avrdude 5.11 buffer overruns in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #43471: avrdude 5.11 buffer overruns in stk500v2 code

Submitted by:  bob frazier <bombasticbob>
Submitted on:  Sat 25 Oct 2014 09:30:35 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: NonePrivacy: Public
Assigned to: NoneOriginator Name: bob frazier
Open/Closed: OpenRelease: None
Programmer hardware: Device type: 

Wed 19 Nov 2014 05:06:46 PM UTC, comment #1:

The problem is that this situation (Xmega but STK500v2 protocol
anyway) is uncommon. The entire code had been tailored on the
non-Xmega devices as Xmegas use their own (different) protocols.

Also, the STK500v2 itself is limited to a maximal message
size of 275 bytes, see AVR068, page 2. That used to cause
the current implementation.

I think the actual issue is that the following procedure
described in AVR068 is not implemented:

"For devices with page size bigger than what can be
transferred to STK500 in one command, several
CMD_PROGRAM_FLASH_ISP commands must be issued. In such a
case, only the last command should have the Write Page mode
bit set."

I wonder whether your bootloader would be able to handle that.

Nevertheless, changing the fixed buffers into malloc'ed
buffers might make a lot of sense. Other programmer
implementations (like those for the JTAGICEs) already do it
that way.

Joerg Wunsch <joerg_wunsch>
Project Administrator
Sat 25 Oct 2014 09:30:35 AM UTC, original submission:

currently, several fixed-length 'on the stack' buffer sizes in the stk500v2 code cause severe failures if the page size for the device you are flashing is larger than 256 bytes. In the case of the ATXMega devices, particularly those with more than 64kb of application area NVRAM, the flash memory page sizes must necessarily be assigned to 512 bytes, possibly more. Applying the patch to stk500v2.c corrects the fixed-length buffer problem by using 'malloc/free' to allocate an arbitrary-sized buffer. NOTE: this patch is NOT complete. It only covers code that affects the use of 'wiring' protocol for uploading images larger than 64kb via the Arduino IDE to an appropriate ATXMega processor with a bootloader that is capable of using this protocol.

bob frazier <bombasticbob>

 

Attached Files
file #32319:  patch-stk500v2.c added by bombasticbob (5KiB - text/x-csrc - patch for stk500v2.c)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by joerg_wunsch (Posted a comment)
  • -unavailable- added by bombasticbob (Submitted the item)
  • -unavailable- added by bombasticbob (may need FreeBSD ports bug report as well until fixed upstream)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 25 Oct 2014 09:30:35 AM UTCbombasticbobAttached File-=>Added patch-stk500v2.c, #32319
      Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1