riot-ci/RIOT
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

gnrc_pktbuf_static.c: fix overflow in gnrc_pktbuf_realloc_data

Browse Source 
This patch fixes overflow, which is caused by
(pkt->size - aligned_size). This happens if pkt->size and
new size are unaligned and the difference
between pkt->size and new size is less than four.
This commit is contained in:
Johann Fischer 2015-12-23 15:34:13 +01:00
parent 26f9f7fa2d
commit 2f94d669d7
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c
View File

@ -179,8 +179,10 @@ int gnrc_pktbuf_realloc_data(gnrc_pktsnip_t *pkt, size_t size)
pkt->data = new_data;
}
else {
_pktbuf_free(((uint8_t *)pkt->data) + aligned_size,
pkt->size - aligned_size);
if (_align(pkt->size) > aligned_size) {
_pktbuf_free(((uint8_t *)pkt->data) + aligned_size,
pkt->size - aligned_size);
}
}
pkt->size = size;
mutex_unlock(&_mutex);