[Tinyos-devel] Bug in TossimActiveMessageC

[Lumir Honus]

Hello,

I'm working on watchdog technique monitoring and during simulation I
found a bug in TossimActiveMessageC.

First how to reproduce it. I use ctp  and simple application which
sends a packet firmly in the interval.
My topology follows next scheme:

0 ---- 1 ---- 2
 \
  \
   3

It means 0 is base station, 2 uses 1 for forwarding packets, 1 and 3
have direct connection to base station.

When I closely watched how node 1 behaves, I found that sometimes it
forwards a wrong packet which it doesn't have in forwarding queue.
This occurs just when a node has some messages to forward in his queue
and it hears (snoops) some other message.

After a very exhaustive debugging :), I found that this is due to line
105 in TossimActiveMessageC --     memcpy(bufferPointer, msg,
sizeof(message_t));

Honestly I don't know exactly why, but bufferPointer points to the
same space in memory as SendQueue which holds messages for forwarding.

FIX:
I tried replace lines
54. <<    message_t buffer;
55. <<    message_t* bufferPointer = &buffer;

by

98     event void Model.receive(message_t* msg) {
99         uint8_t len;
100        void* payload;
101
102  >>  message_t* bufferPointer = (message_t*)malloc(sizeof(message_t));
103        memcpy(bufferPointer, msg, sizeof(message_t));

and everything works ok now.
-- 
---------------------------------------------------------------------
S pozdravem
        Lumir Honus