Menu

#89 Ringbuffer cause memory corruption in dlmstp.c

v1.4.1
accepted
None
5
2024-12-01
2024-11-28
Andrea
No

Hello,

Milestone v1.4.1 but also 1.3.8.
Module "dlmstp.c",
Function "dlmstp_init()":

        Ringbuf_Init(
            &user->PDU_Queue, (volatile uint8_t *)user->PDU_Buffer,
            sizeof(user->PDU_Buffer), DLMSTP_MAX_INFO_FRAMES);

Initialize the single "element_size" of ringbuffer with whole size of "struct dlmstp_packet PDU_Buffer[DLMSTP_MAX_INFO_FRAMES];" and this lead to memory corruption.

Initialization should be modified in:

        Ringbuf_Init(
            &user->PDU_Queue, (volatile uint8_t *)user->PDU_Buffer,
            sizeof(user->PDU_Buffer**[0]**), DLMSTP_MAX_INFO_FRAMES);

Also function "Ringbuf_Init()" can be improved in this way:

bool Ringbuf_Init(RING_BUFFER b,
volatile uint8_t
buffer,
unsigned buffer_size,
unsigned element_size,
unsigned element_count)
{
bool status = false;

if (b && isPowerOfTwo(element_count) && 
   (element_size*element_count) <= buffer_size) {
    b->head = 0;
    b->tail = 0;
    b->buffer = buffer;
    b->element_size = element_size;
    b->element_count = element_count;
    /* tuning diagnostics */
    b->depth = 0;
    status = true;
}

return status;

}

used with:
Ringbuf_Init(&user->PDU_Queue, (volatile uint8_t *)user->PDU_Buffer, sizeof(user->PDU_Buffer),
sizeof(user->PDU_Buffer[0]), DLMSTP_MAX_INFO_FRAMES);

best regards,

Discussion

  • Steve Karg

    Steve Karg - 2024-12-01
    • status: open --> accepted
     
  • Steve Karg

    Steve Karg - 2024-12-01

    Thank you for reporting the defect in the dlmstp initialization. I added a unit test for dlmstp and fixed the initialization ring buffer element size in Github Pull Request #865

     

Anonymous
Anonymous

Add attachments
Cancel





MongoDB Logo MongoDB