[lwip-devel] [patch #10132] fix pbuf->len calculation error in type PBUF_POOL

[Eric.Wu]

URL:
  <https://savannah.nongnu.org/patch/?10132>

                 Summary: fix pbuf->len calculation error in type PBUF_POOL
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: duckpowermb
            Submitted on: Wed 03 Nov 2021 08:42:54 AM UTC
                Category: pbufs
                Priority: 5 - Normal
                  Status: None
                 Privacy: Public
             Assigned to: None
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None

    _______________________________________________________

Details:


pbuf.c line:253

qlen = LWIP_MIN(rem_len, (u16_t)(PBUF_POOL_BUFSIZE_ALIGNED -
LWIP_MEM_ALIGN_SIZE(offset)));

while

pbuf->playload = LWIP_MEM_ALIGN((u8_t *)q + SIZEOF_STRUCT_PBUF + offset))


there is distance of SIZEOF_STRUCT_PBUF

which may makes a pbuf being overwritten by size of SIZEOF_STRUCT_PBUF













    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Wed 03 Nov 2021 08:42:54 AM UTC  Name: pbuf_len_calculation_error.diff 
Size: 729B   By: duckpowermb

<http://savannah.nongnu.org/patch/download.php?file_id=52192>

    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/patch/?10132>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/