Skip to content

Out of bound memory access on dma-proxy-test if verify #4

@Enrico31415

Description

@Enrico31415

The maximum channel size is defined in:

struct channel_buffer {
	unsigned int buffer[BUFFER_SIZE / sizeof(unsigned int)];
	enum proxy_status { PROXY_NO_ERROR = 0, PROXY_BUSY = 1, PROXY_TIMEOUT = 2, PROXY_ERROR = 3 } status;

With
BUFFER_SIZE = 128 * 1024
Making the maximum range of buffer[] 32768 = 128*1024/4.
Assuming sizeof(unsigned int) = 4.

In the case of the user entering a test_size by argv bigger then BUFFER_SIZE, test_size became equals to BUFFER_SIZE
as line 354 of dma-proxy-test.
test_size is then multiplied by 1024 making the maximum value of BUFFER_SIZE*1024 = 128 * 1024 * 1024 = 134217728.

If verify flag is provided, the cycle to verify the buffer should run:

for (i = 0; i < test_size / sizeof(unsigned int); i++)
				buffer[i] = i + ((TX_BUFFER_COUNT / BUFFER_INCREMENT) - 1) + counter;

as line 189. Since typically sizeof(unsigned int) = 4, the for loop runs from 0 to 134217728/4 = 33554432 out the maximum array value.

I think this can be fixed by moving test_size *= 1024; in an else statement of line 353.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions