buglwIP - A Lightweight TCP/IP stack - Bugs: bug #9160, MEM_ALIGN_SIZE used incorrectly in...


You are not allowed to post comments on this tracker with your current authentication level.

bug #9160: MEM_ALIGN_SIZE used incorrectly in pbuf_alloc

Submitted by:  Kieran Mansley <kieranm>
Submitted on:  Sun 30 May 2004 02:00:33 PM UTC  
Category:  pbufs Severity:  2 - Minor
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  Kieran Mansley <kieranm>
Open/Closed:  Closed Planned Release:  None
lwIP version:  None

Sun 30 May 2004 02:09:50 PM UTC, comment #1: 

Recommendation from original submission applied, but we should keep an eye on this as I'm not entirely sure that it's a complete fix.  My doubts stem from whether the base of the pbuf payload (p + sizeof(struct pbuf)), or the initial payload pointer (p->payload) should be aligned.

Kieran Mansley <kieranm>
Project MemberIn charge of this item.
Sun 30 May 2004 02:00:33 PM UTC, original submission:  

We are trying to get lwip to run on our Arm-7 board; however we are
experiencing occasional memory overwrites, and we think that we have tracked
the problem down to a bug in pbuf_alloc(). We use 4 byte alignment (so

In pbuf_alloc() we find the following code fragment:

> p = mem_malloc(MEM_ALIGN_SIZE(sizeof(struct pbuf) + length + offset));
> ...
> p->payload = MEM_ALIGN((void )((u8_t )p + sizeof(struct pbuf) +


"sizeof(struct pbuf)" is 16, and offset in this case is 20+20+6 = 46

When "length" is 21, "sizeof(struct pbuf) + length + offset" becomes 83
which gets (correctly) rounded up by MEM_ALIGN_SIZE to 84.

Then "p + sizeof(struct pbuf) + offset" becomes p+62, and since p is already
allocated on an alignment boundary this gets (correctly) rounded up by
MEM_ALIGN to p+64.

However now "p->payload" points at the 64'th byte in a 84 byte buffer, and
that does not leave room enough for the 21 bytes of payload (length) that we
asked for. A short time later in the code we will get a memory overwrite.

Kieran Mansley <kieranm>
Project MemberIn charge of this item.


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.




Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-05-30 kieranm StatusNone => Fixed
    Open/ClosedOpen => Closed

Back to the top

Powered by Savane 3.5