#1739 closed defect (duplicate)

Possible memory corruption in milkymist BSP ethernet driver

Reported by: Yann Sionneau Owned by: Joel Sherrill
Priority: normal Milestone: 4.11
Component: bsps Version: 4.11
Severity: major Keywords:
Cc: sebastien.bourdeauducq@… Blocked By:
Blocking:

Description

I just pushed on my git repository a patch that, I think, fixes a memory corruption in milkymist BSP ethernet driver.

I am looking for a confirmation that it was a real issue, can someone confirm it ?

url of the commit : https://github.com/fallen/rtems-milkymist/commit/73572adca3f058f389301cc8bb4d924743b48b38

it's a one-liner-patch which modifies the file : c/src/lib/libbsp/lm32/shared/milkymist_networking/network.c

I think the structure (which role is to contain a complete ethernet packet) was too small to handle correctly it's goal.

the raw_data was of length 128 bytes instead of the max Ethernet mtu ( = 1532 bytes ).

I think this could corrupt memory in case of an Ethernet packet > 128 bytes, for example line 401 :

m_copydata(nm, 0, mlen, p.raw_data + len);

which looks OK but it is in a loop where len is increasing at each iteration.

What do you think of that, was I right to push this commit ?

Thanks

Attachments (1)

0001-fixed-length-of-data-member-of-mm_packet-struct-to-b.patch (929 bytes) - added by Yann Sionneau on 02/14/11 at 16:21:19.
patch that fixes the memory corruption issue

Download all attachments as: .zip

Change History (3)

Changed on 02/14/11 at 16:21:19 by Yann Sionneau

patch that fixes the memory corruption issue

comment:1 Changed on 08/01/11 at 09:53:50 by Sebastien Bourdeauducq

Resolution: duplicate
Status: newclosed, sebastien.bourdeauducq@gmail.com

I have rewritten that driver since then.

comment:2 Changed on 11/24/14 at 18:58:28 by Gedare Bloom

Version: HEAD4.11

Replace Version=HEAD with Version=4.11 for the tickets with Milestone >= 4.11

Note: See TracTickets for help on using tickets.