buglwIP - A Lightweight TCP/IP stack - Bugs: bug #9160, MEM_ALIGN_SIZE used incorrectly in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #9160: MEM_ALIGN_SIZE used incorrectly in pbuf_alloc

Submitted by:  Kieran Mansley <kieranm>
Submitted on:  Sun 30 May 2004 02:00:33 PM UTC  
 
Category: pbufsSeverity: 2 - Minor
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Kieran Mansley <kieranm>
Open/Closed: ClosedPlanned Release: None
lwIP version: None

Sun 30 May 2004 02:09:50 PM UTC, comment #1:

Recommendation from original submission applied, but we should keep an eye on this as I'm not entirely sure that it's a complete fix. My doubts stem from whether the base of the pbuf payload (p + sizeof(struct pbuf)), or the initial payload pointer (p->payload) should be aligned.

Kieran Mansley <kieranm>
Project AdministratorIn charge of this item.
Sun 30 May 2004 02:00:33 PM UTC, original submission:

We are trying to get lwip to run on our Arm-7 board; however we are
experiencing occasional memory overwrites, and we think that we have tracked
the problem down to a bug in pbuf_alloc(). We use 4 byte alignment (so
MEM_ALIGNMENT is 4).

In pbuf_alloc() we find the following code fragment:

> p = mem_malloc(MEM_ALIGN_SIZE(sizeof(struct pbuf) + length + offset));
> ...
> p->payload = MEM_ALIGN((void )((u8_t )p + sizeof(struct pbuf) +

offset));

"sizeof(struct pbuf)" is 16, and offset in this case is 20+20+6 = 46

When "length" is 21, "sizeof(struct pbuf) + length + offset" becomes 83
which gets (correctly) rounded up by MEM_ALIGN_SIZE to 84.

Then "p + sizeof(struct pbuf) + offset" becomes p+62, and since p is already
allocated on an alignment boundary this gets (correctly) rounded up by
MEM_ALIGN to p+64.

However now "p->payload" points at the 64'th byte in a 84 byte buffer, and
that does not leave room enough for the 21 bytes of payload (length) that we
asked for. A short time later in the code we will get a memory overwrite.

Kieran Mansley <kieranm>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sun 30 May 2004 02:09:50 PM UTCkieranmStatusNone=>Fixed
  Open/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup1