[Bug 1739] New: Possible memory corruption in milkymist BSP ethernet driver

[bugzilla-daemon at rtems.org]

https://www.rtems.org/bugzilla/show_bug.cgi?id=1739

           Summary: Possible memory corruption in milkymist BSP ethernet
                    driver
           Product: RTEMS
           Version: HEAD
          Platform: lm32
        OS/Version: RTEMS
            Status: NEW
          Severity: major
          Priority: P3
         Component: bsps
        AssignedTo: joel.sherrill at oarcorp.com
        ReportedBy: yann at minet.net


I just pushed on my git repository a patch that, I think, fixes a memory
corruption in milkymist BSP ethernet driver.

I am looking for a confirmation that it was a real issue, can someone confirm
it ?

url of the commit :
https://github.com/fallen/rtems-milkymist/commit/73572adca3f058f389301cc8bb4d924743b48b38

it's a one-liner-patch which modifies the file :
c/src/lib/libbsp/lm32/shared/milkymist_networking/network.c

I think the structure (which role is to contain a complete ethernet packet) was
too small to handle correctly it's goal.

the raw_data was of length 128 bytes instead of the max Ethernet mtu ( = 1532
bytes ).

I think this could corrupt memory in case of an Ethernet packet > 128 bytes,
for example line 401 : 

m_copydata(nm, 0, mlen, p.raw_data + len);

which looks OK but it is in a loop where len is increasing at each iteration.

What do you think of that, was I right to push this commit ?

Thanks

-- 
Configure bugmail: https://www.rtems.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.