[Bug 1739] New: Possible memory corruption in milkymist BSP ethernet driver

bugzilla-daemon at rtems.org bugzilla-daemon at rtems.org
Mon Feb 14 16:53:30 UTC 2011


           Summary: Possible memory corruption in milkymist BSP ethernet
           Product: RTEMS
           Version: HEAD
          Platform: lm32
        OS/Version: RTEMS
            Status: NEW
          Severity: major
          Priority: P3
         Component: bsps
        AssignedTo: joel.sherrill at oarcorp.com
        ReportedBy: yann at minet.net

I just pushed on my git repository a patch that, I think, fixes a memory
corruption in milkymist BSP ethernet driver.

I am looking for a confirmation that it was a real issue, can someone confirm
it ?

url of the commit :

it's a one-liner-patch which modifies the file :

I think the structure (which role is to contain a complete ethernet packet) was
too small to handle correctly it's goal.

the raw_data was of length 128 bytes instead of the max Ethernet mtu ( = 1532
bytes ).

I think this could corrupt memory in case of an Ethernet packet > 128 bytes,
for example line 401 : 

m_copydata(nm, 0, mlen, p.raw_data + len);

which looks OK but it is in a loop where len is increasing at each iteration.

What do you think of that, was I right to push this commit ?


Configure bugmail: https://www.rtems.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

More information about the bugs mailing list