[Tinyos Core WG] cc2420 radio stack, and short packets

[David Moss]

I propose (lines 215-217):

 

        if(rxFrameLength <= MAC_PACKET_SIZE) {

          if(rxFrameLength > 0) {

            if(rxFrameLength >= sizeof(cc2420_header_t)) {

 

 

 

  _____  

From: tinyos-2.0wg-bounces at millennium.berkeley.edu
[mailto:tinyos-2.0wg-bounces at millennium.berkeley.edu] On Behalf Of David Gay
Sent: Tuesday, July 08, 2008 9:37 AM
To: TinyOS Core WG
Subject: [Tinyos Core WG] cc2420 radio stack, and short packets

 

I got a deputy failure from a long running base station (on a micaz):
upper bound coercion:
/home/owl/motes/2.x/tos/chips/cc2420/receive/CC2420ReceiveP.nc:338:
Assertion failed in CLeq:
  CC2420ReceiveP$m_p_rx_buf->data + (unsigned char )((unsigned int )length -
13U) <= CC2420ReceiveP$m_p_rx_buf->data + 28

As far as I can tell, the logic in that file should prevent too-long packets
ever getting there, so my question is: is it conceivable that "too short"
(less than 14 bytes) packets could show up, and cause underflow in the
subtraction? I don't see anything which would prevent such packets getting
as far as receiveDone_task, which contains the subtraction. 

David

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://www.millennium.berkeley.edu/pipermail/tinyos-2.0wg/attachments/20080708/fbdcd787/attachment.htm