bugAVR Downloader/UploaDEr - Bugs: bug #43471, avrdude 5.11 buffer overruns in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #43471: avrdude 5.11 buffer overruns in stk500v2 code

Submitter:  bob frazier <bombasticbob>
Submitted:  Sat 25 Oct 2014 09:30:35 AM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Originator Name:  bob frazier
Open/Closed:  Open Release:  None
Programmer hardware:  Device type: 

Wed 19 Nov 2014 05:06:46 PM UTC, comment #1: 

The problem is that this situation (Xmega but STK500v2 protocol
anyway) is uncommon.  The entire code had been tailored on the
non-Xmega devices as Xmegas use their own (different) protocols.

Also, the STK500v2 itself is limited to a maximal message
size of 275 bytes, see AVR068, page 2.  That used to cause
the current implementation.

I think the actual issue is that the following procedure
described in AVR068 is not implemented:

"For devices with page size bigger than what can be
transferred to STK500 in one command, several
CMD_PROGRAM_FLASH_ISP commands must be issued.  In such a
case, only the last command should have the Write Page mode
bit set."

I wonder whether your bootloader would be able to handle that.

Nevertheless, changing the fixed buffers into malloc'ed
buffers might make a lot of sense.  Other programmer
implementations (like those for the JTAGICEs) already do it
that way.

Joerg Wunsch <joerg_wunsch>
Group administrator
Sat 25 Oct 2014 09:30:35 AM UTC, original submission:  

currently, several fixed-length 'on the stack' buffer sizes in the stk500v2 code cause severe failures if the page size for the device you are flashing is larger than 256 bytes.  In the case of the ATXMega devices, particularly those with more than 64kb of application area NVRAM, the flash memory page sizes must necessarily be assigned to 512 bytes, possibly more.  Applying the patch to stk500v2.c corrects the fixed-length buffer problem by using 'malloc/free' to allocate an arbitrary-sized buffer.  NOTE: this patch is NOT complete.  It only covers code that affects the use of 'wiring' protocol for uploading images larger than 64kb via the Arduino IDE to an appropriate ATXMega processor with a bootloader that is capable of using this protocol.


bob frazier <bombasticbob>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #32319:  patch-stk500v2.c added by bombasticbob (5KiB - text/x-csrc - patch for stk500v2.c)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by joerg_wunsch (Posted a comment)
  • -email is unavailable- added by bombasticbob (Submitted the item)
  • -email is unavailable- added by bombasticbob (may need FreeBSD ports bug report as well until fixed upstream)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-10-25 bombasticbob Attached File- Added patch-stk500v2.c, #32319
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code