buglwIP - A Lightweight TCP/IP stack - Bugs: bug #66097, mem_trim() - wrong behaviour when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #66097: mem_trim() - wrong behaviour when memory-checks are enabled

Submitter:  Marco Scholz <marcoscholz>
Submitted:  Fri 16 Aug 2024 06:37:55 AM UTC
   
 
Category:  pbufs Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  2.2.0

Fri 16 Aug 2024 06:37:55 AM UTC, original submission:  

Hello,

I think I have found a problem in the mem.c - mem_trim() function. The problem occurs when I enable the MEM_OVERFLOW_CHECK. The following example code fails:

void* p=mem_malloc(1000);
p=mem_trim(p,999);

It triggers the assert

LWIP_ASSERT("mem_trim can only shrink memory", newsize <= size);

of line 740 in mem.c
or returns a null pointer depending of the debug configuration.

It looks like the code has problems with the MEM_SANITY_OVERHEAD.
It is not included in "size" in line 739 but it is included in "newsize" in line 715 (in form of MEM_SANITY_REGION_BEFORE_ALIGNED + MEM_SANITY_REGION_AFTER_ALIGNED instead of MEM_SANITY_OVERHEAD)

For security reasons I would like to turn on these checks but my current work around is to disable them because of this.

Best regards,
Marco Scholz

Marco Scholz <marcoscholz>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by marcoscholz (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.15-e6e5.
    Corresponding source code