Mirrors_Framework/nuttx
1
0
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2026-06-06 00:14:22 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SAMV7 Ethernet: Fix a write-past-end-of-buffer and trash-the-heap problem

Browse Source
This commit is contained in:
Gregory Nutt
2015-03-29 16:45:05 -06:00
parent 805be6fee2
commit 8aa133029f
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/arm/src/samv7/sam_emac.c
+12 -12
View File
@@ -4563,28 +4563,28 @@ static void sam_rxreset(struct sam_emac_s *priv, int qid)
/* Configure the RX descriptors. */ /* Configure the RX descriptors. */
xfrq->rxndx = 0; xfrq->rxndx = 0;
for (ndx = 0; ndx < priv->attr->nrxbuffers; ndx++) for (ndx = 0; ndx < xfrq->nrxbuffers; ndx++)
{ {
bufaddr = (uintptr_t)&rxbuffer[ndx * xfrq->rxbufsize]; bufaddr = (uintptr_t)&rxbuffer[ndx * xfrq->rxbufsize];
DEBUGASSERT((bufaddr & ~EMACRXD_ADDR_MASK) == 0); DEBUGASSERT((bufaddr & ~EMACRXD_ADDR_MASK) == 0);
/* Set the buffer address and remove EMACRXD_ADDR_OWNER and /* Set the buffer address and remove EMACRXD_ADDR_OWNER and
* EMACRXD_ADDR_WRAP. * EMACRXD_ADDR_WRAP.
*/ */
rxdesc[ndx].addr = bufaddr; rxdesc[ndx].addr = bufaddr;
rxdesc[ndx].status = 0; rxdesc[ndx].status = 0;
} }
/* Mark the final descriptor in the list */ /* Mark the final descriptor in the list */
rxdesc[priv->attr->nrxbuffers - 1].addr |= EMACRXD_ADDR_WRAP; rxdesc[xfrq->nrxbuffers - 1].addr |= EMACRXD_ADDR_WRAP;
/* Flush the entire RX descriptor table to RAM */ /* Flush the entire RX descriptor table to RAM */
arch_clean_dcache((uintptr_t)rxdesc, arch_clean_dcache((uintptr_t)rxdesc,
(uintptr_t)rxdesc + (uintptr_t)rxdesc +
priv->attr->nrxbuffers * sizeof(struct emac_rxdesc_s)); xfrq->nrxbuffers * sizeof(struct emac_rxdesc_s));
/* Set the Receive Buffer Queue Pointer Register */ /* Set the Receive Buffer Queue Pointer Register */