You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mynewt.apache.org by cc...@apache.org on 2016/03/04 01:40:41 UTC
[61/70] [abbrv] incubator-mynewt-larva git commit: MYNEWT-189: add
bounds checking to os_mbuf_get() and os_mbuf_get_pkthdr(). Add test case to
make sure a user packet header cannot be too big,
as well as the amount of leading space requested
MYNEWT-189: add bounds checking to os_mbuf_get() and os_mbuf_get_pkthdr(). Add test case to make sure a user packet header cannot be too big, as well as the amount of leading space requested
Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/commit/20700036
Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/tree/20700036
Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/diff/20700036
Branch: refs/heads/master
Commit: 207000366ff247e675d5666eb0e3122d1ce2788c
Parents: 5d97f53
Author: wes3 <wi...@micosa.io>
Authored: Wed Mar 2 11:53:08 2016 -0800
Committer: wes3 <wi...@micosa.io>
Committed: Wed Mar 2 11:57:29 2016 -0800
----------------------------------------------------------------------
libs/os/src/os_mbuf.c | 22 +++++++++++++++-------
libs/os/src/test/mbuf_test.c | 27 ++++++++++++++++++++++++---
2 files changed, 39 insertions(+), 10 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/blob/20700036/libs/os/src/os_mbuf.c
----------------------------------------------------------------------
diff --git a/libs/os/src/os_mbuf.c b/libs/os/src/os_mbuf.c
index 27d9443..788987f 100644
--- a/libs/os/src/os_mbuf.c
+++ b/libs/os/src/os_mbuf.c
@@ -177,8 +177,6 @@ _os_msys_find_pool(uint16_t dsize)
return (pool);
}
-
-
struct os_mbuf *
os_msys_get(uint16_t dsize, uint16_t leadingspace)
{
@@ -196,7 +194,6 @@ err:
return (NULL);
}
-
struct os_mbuf *
os_msys_get_pkthdr(uint16_t dsize, uint16_t user_hdr_len)
{
@@ -228,8 +225,8 @@ err:
* @return 0 on success, error code on failure.
*/
int
-os_mbuf_pool_init(struct os_mbuf_pool *omp, struct os_mempool *mp, uint16_t buf_len,
- uint16_t nbufs)
+os_mbuf_pool_init(struct os_mbuf_pool *omp, struct os_mempool *mp,
+ uint16_t buf_len, uint16_t nbufs)
{
omp->omp_databuf_len = buf_len - sizeof(struct os_mbuf);
omp->omp_mbuf_count = nbufs;
@@ -253,6 +250,10 @@ os_mbuf_get(struct os_mbuf_pool *omp, uint16_t leadingspace)
{
struct os_mbuf *om;
+ if (leadingspace > omp->omp_databuf_len) {
+ goto err;
+ }
+
om = os_memblock_get(omp->omp_pool);
if (!om) {
goto err;
@@ -274,13 +275,20 @@ err:
struct os_mbuf *
os_mbuf_get_pkthdr(struct os_mbuf_pool *omp, uint8_t user_pkthdr_len)
{
+ uint16_t pkthdr_len;
struct os_mbuf_pkthdr *pkthdr;
struct os_mbuf *om;
+ /* User packet header must fit inside mbuf */
+ pkthdr_len = user_pkthdr_len + sizeof(struct os_mbuf_pkthdr);
+ if ((pkthdr_len > omp->omp_databuf_len) || (pkthdr_len > 255)) {
+ return NULL;
+ }
+
om = os_mbuf_get(omp, 0);
if (om) {
- om->om_pkthdr_len = user_pkthdr_len + sizeof(struct os_mbuf_pkthdr);
- om->om_data += user_pkthdr_len + sizeof(struct os_mbuf_pkthdr);
+ om->om_pkthdr_len = pkthdr_len;
+ om->om_data += pkthdr_len;
pkthdr = OS_MBUF_PKTHDR(om);
pkthdr->omp_len = 0;
http://git-wip-us.apache.org/repos/asf/incubator-mynewt-larva/blob/20700036/libs/os/src/test/mbuf_test.c
----------------------------------------------------------------------
diff --git a/libs/os/src/test/mbuf_test.c b/libs/os/src/test/mbuf_test.c
index 2016021..dd4121d 100644
--- a/libs/os/src/test/mbuf_test.c
+++ b/libs/os/src/test/mbuf_test.c
@@ -23,10 +23,14 @@
#include <string.h>
-#define MBUF_TEST_POOL_BUF_SIZE (256)
-#define MBUF_TEST_POOL_BUF_COUNT (10)
+/*
+ * NOTE: currently, the buffer size cannot be changed as some tests are
+ * hard-coded for this size.
+ */
+#define MBUF_TEST_POOL_BUF_SIZE (256)
+#define MBUF_TEST_POOL_BUF_COUNT (10)
-#define MBUF_TEST_DATA_LEN (1024)
+#define MBUF_TEST_DATA_LEN (1024)
static os_membuf_t os_mbuf_membuf[OS_MEMPOOL_SIZE(MBUF_TEST_POOL_BUF_SIZE,
MBUF_TEST_POOL_BUF_COUNT)];
@@ -106,6 +110,22 @@ TEST_CASE(os_mbuf_test_alloc)
TEST_ASSERT_FATAL(rc == 0, "Error free'ing mbuf %d", rc);
}
+TEST_CASE(os_mbuf_test_get_pkthdr)
+{
+ struct os_mbuf *m;
+
+ os_mbuf_test_setup();
+
+#if (MBUF_TEST_POOL_BUF_SIZE <= 256)
+ m = os_mbuf_get_pkthdr(&os_mbuf_pool, MBUF_TEST_POOL_BUF_SIZE - 1);
+ TEST_ASSERT_FATAL(m == NULL, "Error: should not have returned mbuf");
+#endif
+
+ m = os_mbuf_get(&os_mbuf_pool, MBUF_TEST_POOL_BUF_SIZE);
+ TEST_ASSERT_FATAL(m == NULL, "Error: should not have returned mbuf");
+}
+
+
TEST_CASE(os_mbuf_test_dup)
{
struct os_mbuf *om;
@@ -396,4 +416,5 @@ TEST_SUITE(os_mbuf_test_suite)
os_mbuf_test_pullup();
os_mbuf_test_extend();
os_mbuf_test_adj();
+ os_mbuf_test_get_pkthdr();
}