RIOT-OS/RIOT
RIOT-OS/RIOT
1
0
Fork 0
mirror of https://github.com/RIOT-OS/RIOT.git synced 2024-12-29 04:50:03 +01:00
Code Releases Activity

sys/net/gnrc_pktbuf: detect use after free if canary is in metadata

Browse Source
This commit is contained in:
Benjamin Valentin 2024-11-14 15:28:32 +01:00
parent ea1670ab0f
commit 83f5b261a8
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/net/gnrc/pktbuf/gnrc_pktbuf.c
View File

@ -93,6 +93,14 @@ void gnrc_pktbuf_release_error(gnrc_pktsnip_t *pkt, uint32_t err)
assert(gnrc_pktbuf_contains(pkt));
assert(pkt->users > 0);
tmp = pkt->next;
/* if the memory was freed, memory has been overwritten by CANARY */
if (CONFIG_GNRC_PKTBUF_CHECK_USE_AFTER_FREE &&
pkt->users == GNRC_PKTBUF_CANARY) {
puts("gnrc_pktbuf: double free detected\n");
DEBUG_BREAKPOINT(3);
}
if (pkt->users == 1) {
pkt->users = 0; /* not necessary but to be on the safe side */
if (!IS_USED(MODULE_GNRC_TX_SYNC)

7
sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c
View File

@ -218,6 +218,13 @@ gnrc_pktsnip_t *gnrc_pktbuf_start_write(gnrc_pktsnip_t *pkt)
mutex_unlock(&gnrc_pktbuf_mutex);
return NULL;
}
if (CONFIG_GNRC_PKTBUF_CHECK_USE_AFTER_FREE &&
pkt->users == GNRC_PKTBUF_CANARY) {
puts("gnrc_pktbuf: use after free detected\n");
DEBUG_BREAKPOINT(3);
}
if (pkt->users > 1) {
gnrc_pktsnip_t *new;
new = _create_snip(pkt->next, pkt->data, pkt->size, pkt->type);