bugAVR Downloader/UploaDEr - Bugs: bug #39691, Buffer overrun when reading EEPROM...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #39691: Buffer overrun when reading EEPROM byte with JTAGICE3

Submitter:  David Glaze <djglaze>
Submitted:  Sun 04 Aug 2013 04:52:14 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  joerg_wunsch Originator Name:  David Glaze
Open/Closed:  Closed Release:  None
Programmer hardware:  Device type: 

Tue 03 Sep 2013 12:00:01 PM UTC, comment #1: 

Fixed in SVN r1202.

The problem turned out that (PGM)->eeprom_pagesize was never
set to the actual page size, so the page cache being allocated
was not usable by anything except free().

I kept the caching inside jtag3_read_byte() as I think it's
still useful to have.

Joerg Wunsch <joerg_wunsch>
Group administrator
Sun 04 Aug 2013 04:52:14 PM UTC, original submission:  

Avrdude has a bug that causes it to write outside a buffer when attempting to use the erase-rewrite cycle counter feature (-y) with the JTAGICE3 programmer on an ATxmega128A3U part.  The resulting error is:


*** glibc detected *** avrdude: malloc(): memory corruption (fast): 0x0000000000675350 ***


The problem has been tracked down to the jtag3_read_byte() routine in jtag3.c, in the code snippit:


  } else if (strcmp(mem->desc, "eeprom") == 0) {
    if ( (pgm->flag & PGM_FL_IS_DW) || ( p->flags & AVRPART_HAS_PDI ) ) {
      cmd[3] = MTYPE_EEPROM;
    } else {
      cmd[3] = MTYPE_EEPROM_PAGE;
    }
    pagesize = mem->page_size;
    paddr = addr & ~(pagesize - 1);
    paddr_ptr = &PDATA(pgm)->eeprom_pageaddr;
    cache_ptr = PDATA(pgm)->eeprom_pagecache;
  } else if (strcmp(mem->desc, "lfuse") == 0) {


I believe this should instead be:


  } else if (strcmp(mem->desc, "eeprom") == 0) {
    if ( (pgm->flag & PGM_FL_IS_DW) || ( p->flags & AVRPART_HAS_PDI ) ) {
      cmd[3] = MTYPE_EEPROM;
    } else {
      cmd[3] = MTYPE_EEPROM_PAGE;
      pagesize = mem->page_size;
      paddr = addr & ~(pagesize - 1);
      paddr_ptr = &PDATA(pgm)->eeprom_pageaddr;
      cache_ptr = PDATA(pgm)->eeprom_pagecache;
    }
  } else if (strcmp(mem->desc, "lfuse") == 0) {


so that when doing a byte read (MTYPE_EEPROM), the pagesize variable remains unset and won't trigger the page buffering routines below.

This fix appears to work correctly for me, although it then reveals other downwind issues (which have been submitted in another ticket).

David Glaze <djglaze>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by joerg_wunsch (Posted a comment)
  • -email is unavailable- added by djglaze (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-09-03 joerg_wunsch StatusNone Fixed
        Assigned toNone joerg_wunsch
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code