Opened on 02/14/11 at 15:53:29
Last modified on 08/01/11 at 09:53:50
#1739 closed defect (duplicate)
Possible memory corruption in milkymist BSP ethernet driver
Reported by: | Yann Sionneau | Owned by: | Joel Sherrill |
---|---|---|---|
Priority: | normal | Milestone: | 4.11 |
Component: | bsps | Version: | 4.11 |
Severity: | major | Keywords: | |
Cc: | sebastien.bourdeauducq@… | Blocked By: | |
Blocking: |
Description
I just pushed on my git repository a patch that, I think, fixes a memory corruption in milkymist BSP ethernet driver.
I am looking for a confirmation that it was a real issue, can someone confirm it ?
url of the commit : https://github.com/fallen/rtems-milkymist/commit/73572adca3f058f389301cc8bb4d924743b48b38
it's a one-liner-patch which modifies the file : c/src/lib/libbsp/lm32/shared/milkymist_networking/network.c
I think the structure (which role is to contain a complete ethernet packet) was too small to handle correctly it's goal.
the raw_data was of length 128 bytes instead of the max Ethernet mtu ( = 1532 bytes ).
I think this could corrupt memory in case of an Ethernet packet > 128 bytes, for example line 401 :
m_copydata(nm, 0, mlen, p.raw_data + len);
which looks OK but it is in a loop where len is increasing at each iteration.
What do you think of that, was I right to push this commit ?
Thanks
Attachments (1)
Change History (3)
Changed on 02/14/11 at 16:21:19 by Yann Sionneau
Attachment: | 0001-fixed-length-of-data-member-of-mm_packet-struct-to-b.patch added |
---|
comment:1 Changed on 08/01/11 at 09:53:50 by Sebastien Bourdeauducq
Resolution: | → duplicate |
---|---|
Status: | new → closed, sebastien.bourdeauducq@gmail.com |
I have rewritten that driver since then.
comment:2 Changed on 11/24/14 at 18:58:28 by Gedare Bloom
Version: | HEAD → 4.11 |
---|
Replace Version=HEAD with Version=4.11 for the tickets with Milestone >= 4.11
patch that fixes the memory corruption issue