Sfoglia il codice sorgente

Fix intermittent RadioLib static SPI buffer overflow

When RADIOLIB_STATIC_ONLY=1 is set, RadioLib's SPItransferStream()
allocates two fixed-size stack buffers (buffOut and buffIn) of
RADIOLIB_STATIC_ARRAY_SIZE bytes each, instead of heap-allocating
exactly the right size.

The default value of RADIOLIB_STATIC_ARRAY_SIZE is 256.  When receiving
a maximum-size LoRa packet (255 bytes, equal to MAX_TRANS_UNIT),
SX126x::readBuffer() passes a 3-byte SPI command header
(CMD_READ_BUFFER + offset + NOP) plus 255 bytes of payload to
SPItransferStream(), for a total buffLen of 258 bytes.  This overflows
the 256-byte stack buffers by 2 bytes, corrupting adjacent locals and
occasionally the stack canary, triggering __stack_chk_fail.

The same overflow occurs on the transmit path: SX126x::writeBuffer()
passes a 2-byte command header plus 255 bytes of payload (buffLen=257),
also overflowing the 256-byte buffer.

The overflow is small (2 bytes on the read path, 1 byte on the write
path), so it only intermittently reaches the stack canary depending on
compiler-generated stack frame layout.

Set RADIOLIB_STATIC_ARRAY_SIZE=260 to eliminate the overflow on both
paths, with 2 bytes of margin on the read path (258 < 260) and 3 bytes
on the write path (257 < 260). The value is placed in [arduino_base] so
it applies to all target platforms.
Valentin V. Bartenev 2 mesi fa
parent
commit
86154ce8d0
1 ha cambiato i file con 1 aggiunte e 0 eliminazioni
  1. 1 0
      platformio.ini

+ 1 - 0
platformio.ini

@@ -25,6 +25,7 @@ lib_deps =
   melopero/Melopero RV3028 @ ^1.1.0
   electroniccats/CayenneLPP @ 1.6.1
 build_flags = -w -DNDEBUG -DRADIOLIB_STATIC_ONLY=1 -DRADIOLIB_GODMODE=1
+  -D RADIOLIB_STATIC_ARRAY_SIZE=260
   -D LORA_FREQ=869.618
   -D LORA_BW=62.5
   -D LORA_SF=8