Menu

#27 Buffer overflow with immediate data

open
nobody
None
5
2014-07-31
2008-11-16
No

If the initiator sends immediate data that is larger than CONFIG_TARGET_MAX_IMMEDIATE, it will overflow the target_cmd_t buffer. This can easily occur with the default values since the target will negotiate a FirstBurstLength up to 1MB, but the immediate buffer is only 65K. The default size of the immediate buffer needs to be increased, or dynamically allocated. Also, range checking should be added to prevent buffer overflow when writing to the immediate buffer.

Discussion


Log in to post a comment.

MongoDB Logo MongoDB