buglwIP - A Lightweight TCP/IP stack - Bugs: bug #9160, MEM_ALIGN_SIZE used incorrectly in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #9160: MEM_ALIGN_SIZE used incorrectly in pbuf_alloc

Submitter:  Kieran Mansley <kieranm>
Submitted:  Sun 30 May 2004 02:00:33 PM UTC
   
 
Category:  pbufs Severity:  2 - Minor
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  kieranm
Open/Closed:  Closed Planned Release:  None
lwIP version:  None

Sun 30 May 2004 02:09:50 PM UTC, comment #1: 

Recommendation from original submission applied, but we should keep an eye on this as I'm not entirely sure that it's a complete fix.  My doubts stem from whether the base of the pbuf payload (p + sizeof(struct pbuf)), or the initial payload pointer (p->payload) should be aligned.

Kieran Mansley <kieranm>
Group Member
Sun 30 May 2004 02:00:33 PM UTC, original submission:  


We are trying to get lwip to run on our Arm-7 board; however we are
experiencing occasional memory overwrites, and we think that we have tracked
the problem down to a bug in pbuf_alloc(). We use 4 byte alignment (so
MEM_ALIGNMENT is 4).

In pbuf_alloc() we find the following code fragment:

> p = mem_malloc(MEM_ALIGN_SIZE(sizeof(struct pbuf) + length + offset));
> ...
> p->payload = MEM_ALIGN((void )((u8_t )p + sizeof(struct pbuf) +

offset));

"sizeof(struct pbuf)" is 16, and offset in this case is 20+20+6 = 46

When "length" is 21, "sizeof(struct pbuf) + length + offset" becomes 83
which gets (correctly) rounded up by MEM_ALIGN_SIZE to 84.

Then "p + sizeof(struct pbuf) + offset" becomes p+62, and since p is already
allocated on an alignment boundary this gets (correctly) rounded up by
MEM_ALIGN to p+64.

However now "p->payload" points at the 64'th byte in a 84 byte buffer, and
that does not leave room enough for the 21 bytes of payload (length) that we
asked for. A short time later in the code we will get a memory overwrite.

Kieran Mansley <kieranm>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-05-30 kieranm StatusNone Fixed
    Open/ClosedOpen Closed

Back to the top

Powered by Savane 3.13-758e.
Corresponding source code