Skip to content

Out of bound memory access on dma-proxy-test if verify #4

@Enrico31415

Description

@Enrico31415

The maximum channel size is defined in:

struct channel_buffer {
	unsigned int buffer[BUFFER_SIZE / sizeof(unsigned int)];
	enum proxy_status { PROXY_NO_ERROR = 0, PROXY_BUSY = 1, PROXY_TIMEOUT = 2, PROXY_ERROR = 3 } status;

With
BUFFER_SIZE = 128 * 1024
Making the maximum range of buffer[] 32768 = 128*1024/4.
Assuming sizeof(unsigned int) = 4.

In the case of the user entering a test_size by argv bigger then BUFFER_SIZE, test_size became equals to BUFFER_SIZE
as line 354 of dma-proxy-test.
test_size is then multiplied by 1024 making the maximum value of BUFFER_SIZE*1024 = 128 * 1024 * 1024 = 134217728.

If verify flag is provided, the cycle to verify the buffer should run:

for (i = 0; i < test_size / sizeof(unsigned int); i++)
				buffer[i] = i + ((TX_BUFFER_COUNT / BUFFER_INCREMENT) - 1) + counter;

as line 189. Since typically sizeof(unsigned int) = 4, the for loop runs from 0 to 134217728/4 = 33554432 out the maximum array value.

I think this can be fixed by moving test_size *= 1024; in an else statement of line 353.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions