buglwIP - A Lightweight TCP/IP stack - Bugs: bug #43437, Memory corruption beyound memory...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #43437: Memory corruption beyound memory pool

Submitted by:  Piotr <michcior>
Submitted on:  Sat 18 Oct 2014 07:12:23 PM UTC  
 
Category: pbufsSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Invalid
Privacy: PublicAssigned to: None
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.4.1

Mon 20 Oct 2014 05:36:05 AM UTC, comment #4:

That's why I wondered if this was from reading the code.

> So, it points to a buffer, which is reserved outside LwIP. I
> have reserved this buffer to be e.g:
> u8_t a_buffer[MEM_SIZE];


So it is your fault. Please do read the instructions around the lines where LWIP_RAM_HEAP_POINTER is checked in mem.c on how to calculate the heap size.

Simon Goldschmidt <goldsimon>
Project Administrator
Sun 19 Oct 2014 04:10:56 PM UTC, comment #3:

The default allocation is:

u8_t ram_heap[MEM_SIZE_ALIGNED + (2*SIZEOF_STRUCT_MEM) + MEM_ALIGNMENT];

so this shortage must be a problem with your port.

Ivan Delamer <idelamer>
Project Member
Sat 18 Oct 2014 09:09:55 PM UTC, comment #2:

I saw it "in action" :)

The "ram" is set like this:
ram = (u8_t *)LWIP_MEM_ALIGN(LWIP_RAM_HEAP_POINTER);
So, it points to a buffer, which is reserved outside LwIP. I have reserved this buffer to be e.g:

u8_t a_buffer[MEM_SIZE];

then (lwipopts.h):
#define LWIP_RAM_HEAP_POINTER a_buffer

It is clear that code in mem_init sets "ram_end" to the end of the buffer and hence all writings to this structure corrupt variables located after the pool.

Simple workaround
u8_t a_buffer[MEM_SIZE+8];

Fixes it.

Maybe I have missed something from the "porting" steps, that could be the case as well.

Ragards,
Piotr.

Piotr <michcior>
Sat 18 Oct 2014 08:52:12 PM UTC, comment #1:

Have you seen that 'ram' is only a pointer to 'ram_heap'? Have you checked the size of 'ram_heap'? Have you actually seen memory corruption or is this only from reading the code???

Simon Goldschmidt <goldsimon>
Project Administrator
Sat 18 Oct 2014 07:12:23 PM UTC, original submission:

In the mem_init (mem.c) The code assigns to "ram_end" the top of the pool. Then, if the pool was declared without spare bytes, the following instructions corrupt memory, which is located just after memory pool.

ram_end = (struct mem )(void )&ram[MEM_SIZE_ALIGNED];
ram_end->used = 1;
ram_end->next = MEM_SIZE_ALIGNED;
ram_end->prev = MEM_SIZE_ALIGNED;

Piotr <michcior>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by idelamer (Posted a comment)
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by michcior (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 20 Oct 2014 05:36:05 AM UTCgoldsimonStatusWorks For Me=>Invalid
      Open/ClosedOpen=>Closed
    Sat 18 Oct 2014 08:52:12 PM UTCgoldsimonStatusNone=>Works For Me

    Back to the top


    Powered by Savane 3.1-cleanup1