Uploaded image for project: 'EtherNet/IP Core V3'
  1. EtherNet/IP Core V3
  2. PSEIP-92

CipObj_RequestAsync_HighPrio_NoResponseData() overwrites stack memory of calling worker

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: V3.5.0.0
    • Fix Version/s: V3.5.0.4, V3.5.1.0, V3.6.0.0
    • Component/s: None
    • Labels:
      None
    • Account:
      SPC EthernetIp Core (SPCETHERNET)

      Description

      The function CipObj_RequestAsync_HighPrio_NoResponseData() passes a local variable "tResponse" to a job that is executed in another worker context.

      void CipObj_RequestAsync_HighPrio_NoResponseData(EIP_H                    hEip,
                                                       CIP_OBJ_ASYNC_REQUEST_T* ptRequest,
                                                       CIP_OBJ_RESPONSE_CB      fnCallback,
                                                       void*                    pvParam)
      {
        CIP_OBJ_RESPONSE_T tResponse;
      
        ptRequest->fnCallback             = fnCallback;
        ptRequest->pvCallbackParameter    = pvParam;
        ptRequest->tJob.pfnFunc = CipObj_RequestAsync_job;
        ptRequest->pvJobParam   = hEip->hCipObjectDict;
      
        ptRequest->ptResponse = &tResponse;
        ptRequest->ptResponse->pbData = NULL;
        PS_Worker_QueueJob( hEip->hCipObjectDict->hWorker_HighPrio, &ptRequest->tJob );
      }

      ptRequest->ptResponse must not be assigned a local variable!

        Attachments

          Issue Links

            Expenses

              Activity

                Status Description

                  People

                  • Reporter:
                    KMichel Kai Michel
                  • Votes:
                    0 Vote for this issue
                    Watchers:
                    0 Start watching this issue

                    Dates

                    • Created:
                      Updated:
                      Resolved: