This is the mail archive of the
ecos-discuss@sourceware.org
mailing list for the eCos project.
Re: bug in eth_drv_send (memory overwrite)
> Fair enough - it can go through here too many times :-(
> The check should be:
>
> if (m->m_next && (MAX_ETH_DRV_SG <= sg_len )) {
>
> Otherwise, it would error out if your mbuf chain was exactly
> MAX_ETH_DRV_SG buffers long.
Ok, this is the perfect solution.
> Can you provide a test case that causes such mbuf fragmentation?
The skeleton of my application is as simple as:
char buf[100];
int s = socket_open(...);
int rc;
for (int i = 0; i < 100; i++) {
rc = write(s, buf, 46); // 46 is my concrete number in the application
if (rc <= 0)
printf("Socket error"); // never prints anything.
}
It caused lists of length 33,34 (default length is 32).
If it can't cause the problem, I have to see more in the details.
If you need, I can write a simple stand-alone main.c to reproduce the problem.
--
Before posting, please read the FAQ: http://ecos.sourceware.org/fom/ecos
and search the list archive: http://ecos.sourceware.org/ml/ecos-discuss