[avrdude-dev] [bug #43471] avrdude 5.11 buffer overruns in stk500v2 code

[bob frazier]

URL:
  <http://savannah.nongnu.org/bugs/?43471>

                 Summary: avrdude 5.11 buffer overruns in stk500v2 code
                 Project: AVR Downloader/UploaDEr
            Submitted by: bombasticbob
            Submitted on: Sat 25 Oct 2014 09:30:35 AM GMT
                Category: None
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
         Originator Name: bob frazier
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:

currently, several fixed-length 'on the stack' buffer sizes in the stk500v2
code cause severe failures if the page size for the device you are flashing is
larger than 256 bytes.  In the case of the ATXMega devices, particularly those
with more than 64kb of application area NVRAM, the flash memory page sizes
must necessarily be assigned to 512 bytes, possibly more.  Applying the patch
to stk500v2.c corrects the fixed-length buffer problem by using 'malloc/free'
to allocate an arbitrary-sized buffer.  NOTE: this patch is NOT complete.  It
only covers code that affects the use of 'wiring' protocol for uploading
images larger than 64kb via the Arduino IDE to an appropriate ATXMega
processor with a bootloader that is capable of using this protocol.





    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Sat 25 Oct 2014 09:30:35 AM GMT  Name: patch-stk500v2.c  Size: 5kB   By:
bombasticbob
patch for stk500v2.c
<http://savannah.nongnu.org/bugs/download.php?file_id=32319>

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?43471>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/