diff options
| author | Gregory Nutt <gnutt@nuttx.org> | 2015-03-29 16:45:05 -0600 |
|---|---|---|
| committer | Gregory Nutt <gnutt@nuttx.org> | 2015-03-29 16:45:05 -0600 |
| commit | c85622aa7b7d87ad42b5aad4db16435cc5db07fe (patch) | |
| tree | 8edc4f2b829b15745ff22118324853de144b2e9f /nuttx/arch | |
| parent | b6cd2d9e62454a948233c1b6a019b64d5d1c30cd (diff) | |
| download | px4-nuttx-c85622aa7b7d87ad42b5aad4db16435cc5db07fe.tar.gz px4-nuttx-c85622aa7b7d87ad42b5aad4db16435cc5db07fe.tar.bz2 px4-nuttx-c85622aa7b7d87ad42b5aad4db16435cc5db07fe.zip | |
SAMV7 Ethernet: Fix a write-past-end-of-buffer and trash-the-heap problem
Diffstat (limited to 'nuttx/arch')
| -rw-r--r-- | nuttx/arch/arm/src/samv7/sam_emac.c | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/nuttx/arch/arm/src/samv7/sam_emac.c b/nuttx/arch/arm/src/samv7/sam_emac.c index 80792687a..4ee2e3709 100644 --- a/nuttx/arch/arm/src/samv7/sam_emac.c +++ b/nuttx/arch/arm/src/samv7/sam_emac.c @@ -4563,28 +4563,28 @@ static void sam_rxreset(struct sam_emac_s *priv, int qid) /* Configure the RX descriptors. */ xfrq->rxndx = 0; - for (ndx = 0; ndx < priv->attr->nrxbuffers; ndx++) - { - bufaddr = (uintptr_t)&rxbuffer[ndx * xfrq->rxbufsize]; - DEBUGASSERT((bufaddr & ~EMACRXD_ADDR_MASK) == 0); + for (ndx = 0; ndx < xfrq->nrxbuffers; ndx++) + { + bufaddr = (uintptr_t)&rxbuffer[ndx * xfrq->rxbufsize]; + DEBUGASSERT((bufaddr & ~EMACRXD_ADDR_MASK) == 0); - /* Set the buffer address and remove EMACRXD_ADDR_OWNER and - * EMACRXD_ADDR_WRAP. - */ + /* Set the buffer address and remove EMACRXD_ADDR_OWNER and + * EMACRXD_ADDR_WRAP. + */ - rxdesc[ndx].addr = bufaddr; - rxdesc[ndx].status = 0; - } + rxdesc[ndx].addr = bufaddr; + rxdesc[ndx].status = 0; + } /* Mark the final descriptor in the list */ - rxdesc[priv->attr->nrxbuffers - 1].addr |= EMACRXD_ADDR_WRAP; + rxdesc[xfrq->nrxbuffers - 1].addr |= EMACRXD_ADDR_WRAP; /* Flush the entire RX descriptor table to RAM */ arch_clean_dcache((uintptr_t)rxdesc, (uintptr_t)rxdesc + - priv->attr->nrxbuffers * sizeof(struct emac_rxdesc_s)); + xfrq->nrxbuffers * sizeof(struct emac_rxdesc_s)); /* Set the Receive Buffer Queue Pointer Register */ |