sergiotarxz/nuttx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SAMV7 Ethernet: Fix a write-past-end-of-buffer and trash-the-heap problem

Browse Source
This commit is contained in:
Gregory Nutt 2015-03-29 16:45:05 -06:00
parent 805be6fee2
commit 8aa133029f
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
arch/arm/src/samv7/sam_emac.c
View File

@ -4563,28 +4563,28 @@ static void sam_rxreset(struct sam_emac_s *priv, int qid)
/* Configure the RX descriptors. */
xfrq->rxndx = 0;
for (ndx = 0; ndx < priv->attr->nrxbuffers; ndx++)
{
bufaddr = (uintptr_t)&rxbuffer[ndx * xfrq->rxbufsize];
DEBUGASSERT((bufaddr & ~EMACRXD_ADDR_MASK) == 0);
for (ndx = 0; ndx < xfrq->nrxbuffers; ndx++)
{
bufaddr = (uintptr_t)&rxbuffer[ndx * xfrq->rxbufsize];
DEBUGASSERT((bufaddr & ~EMACRXD_ADDR_MASK) == 0);
/* Set the buffer address and remove EMACRXD_ADDR_OWNER and
* EMACRXD_ADDR_WRAP.
*/
/* Set the buffer address and remove EMACRXD_ADDR_OWNER and
* EMACRXD_ADDR_WRAP.
*/
rxdesc[ndx].addr = bufaddr;
rxdesc[ndx].status = 0;
}
rxdesc[ndx].addr = bufaddr;
rxdesc[ndx].status = 0;
}
/* Mark the final descriptor in the list */
rxdesc[priv->attr->nrxbuffers - 1].addr |= EMACRXD_ADDR_WRAP;
rxdesc[xfrq->nrxbuffers - 1].addr |= EMACRXD_ADDR_WRAP;
/* Flush the entire RX descriptor table to RAM */
arch_clean_dcache((uintptr_t)rxdesc,
(uintptr_t)rxdesc +
priv->attr->nrxbuffers * sizeof(struct emac_rxdesc_s));
xfrq->nrxbuffers * sizeof(struct emac_rxdesc_s));
/* Set the Receive Buffer Queue Pointer Register */