From: Robin Farine <acnrf@dial.eunet.ch>
To: Fabrice Gautier <Fabrice_Gautier@sdesigns.com>
Cc: "'Jonathan Larmour'" <jlarmour@redhat.com>,
"Ecos-List (E-mail)" <ecos-discuss@sourceware.cygnus.com>
Subject: Re: [ECOS] Redboot network setup
Date: Fri, 14 Sep 2001 00:17:00 -0000 [thread overview]
Message-ID: <864rq6uu5l.fsf@halftrack.hq.acn-group.ch> (raw)
In-Reply-To: <B1F6452C89AFD411AE0800A0CC734C230150A8@EMAIL1>
Shouldn't the error case call eth_drv_msg_put(ð_msg_free, msg)?
+ if(msg->len > len || msg->len < 14){
+ diag_printf("ETHERNET PACKET ERROR: msg->len <0 or > len\n");
+ eth_drv_msg_put(ð_msg_free, msg);
+ return 0;
+ }
Robin
Fabrice Gautier <Fabrice_Gautier@sdesigns.com> writes:
> > From: Jonathan Larmour [ mailto:jlarmour@redhat.com ]
> > Subject: Re: [ECOS] Redboot network setup
> >
> > There shouldn't be anything needing a timeout on a
> > non-blocking read. In the other ports you're looking at it's only the
> non-virtual
> > vector blocking read functions that have these timeouts.
>
> Right,
>
> I think I found another problem which caused Redboot to hang. It seems that
> the size of the Ethernet packets are not checked before being used as
> arguments for memcopy in eth_drv_read. There is also a "len" argument in
> this function which is not used. I did this modification:
>
> Index: eth_drv.c
> ===================================================================
> RCS file: /cvs/ecos/ecos/packages/io/eth/current/src/stand_alone/eth_drv.c,v
> retrieving revision 1.10
> diff -u -r1.10 eth_drv.c
> --- eth_drv.c 2001/08/17 16:37:36 1.10
> +++ eth_drv.c 2001/09/14 01:59:47
> @@ -341,6 +341,10 @@
> msg = eth_drv_msg_get(ð_msg_full);
> if (msg) {
> memcpy(eth_hdr, msg->data, 14);
> + if(msg->len > len || msg->len < 14){
> + diag_printf("ETHERNET PACKET ERROR: msg->len <0 or >
> len\n");
> + return 0;
> + }
> memcpy(buf, &msg->data[14], msg->len-14);
> eth_drv_msg_put(ð_msg_free, msg);
> res = msg->len;
>
>
> and it seems to works somewhat...
next prev parent reply other threads:[~2001-09-14 0:17 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-09-13 19:30 Fabrice Gautier
2001-09-14 0:17 ` Robin Farine [this message]
-- strict thread matches above, loose matches on Subject: below --
2001-09-20 10:15 Fabrice Gautier
2001-09-20 10:32 ` Jonathan Larmour
2001-09-19 21:27 Fabrice Gautier
2001-09-20 4:51 ` Jonathan Larmour
2001-09-13 17:10 Fabrice Gautier
2001-09-13 18:13 ` Jonathan Larmour
2001-09-13 16:19 Fabrice Gautier
2001-09-13 16:25 ` Jonathan Larmour
2001-09-13 15:33 Fabrice Gautier
2001-09-13 16:03 ` Jonathan Larmour
2001-09-13 12:16 Fabrice Gautier
2001-09-13 14:35 ` Jonathan Larmour
2001-09-12 17:04 Fabrice Gautier
2001-09-12 17:13 ` Gary Thomas
2001-09-13 11:16 ` Jonathan Larmour
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=864rq6uu5l.fsf@halftrack.hq.acn-group.ch \
--to=acnrf@dial.eunet.ch \
--cc=Fabrice_Gautier@sdesigns.com \
--cc=ecos-discuss@sourceware.cygnus.com \
--cc=jlarmour@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).