MCU-PLUS-SDK-AM263X: CANFD drivers: CANFD_isDataSizeValid() function can lead to out-of-bounds memory access

Davide Pagliai

Part Number: MCU-PLUS-SDK-AM263X
Other Parts Discussed in Thread: SYSCONFIG

The function CANFD_isDataSizeValid() contains an implementation error that can lead to out-of-bounds memory access.

int32_t CANFD_isDataSizeValid(uint32_t dataSize)
{
uint32_t canfdDataSize[CANFD_MAX_DLC_MAPPING] =
{0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U,
12U, 16U, 20U, 24U, 32U, 48U, 64U};

if((canfdDataSize[dataSize] == 0U) ||

(canfdDataSize[dataSize] == 1U) ||

(canfdDataSize[dataSize] == 2U) ||

(canfdDataSize[dataSize] == 3U) ||

(canfdDataSize[dataSize] == 4U) ||

(canfdDataSize[dataSize] == 5U) ||

(canfdDataSize[dataSize] == 6U) ||

(canfdDataSize[dataSize] == 7U) ||

(canfdDataSize[dataSize] == 8U) ||

(canfdDataSize[dataSize] == 12U) ||

(canfdDataSize[dataSize] == 16U) ||

(canfdDataSize[dataSize] == 20U) ||

(canfdDataSize[dataSize] == 24U) ||

(canfdDataSize[dataSize] == 32U) ||

(canfdDataSize[dataSize] == 48U) ||

(canfdDataSize[dataSize] == 64U))

{

return SystemP_SUCCESS;

}

return SystemP_FAILURE;

}

The function incorrectly uses the input parameter dataSize as an index into the canfdDataSize[] array. However, dataSize represents the number of bytes in the CAN FD frame, which can range from 0 to 64. The canfdDataSize[] array contains only 16 elements, so passing a dataSize value greater than 15 results in accessing memory outside the bounds of the array.

Below is the correct implementation of the function:

int32_t CANFD_isDataSizeValid(uint32_t dataSize)
{
uint32_t canfdDataSize[CANFD_MAX_DLC_MAPPING] =
{0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U,
12U, 16U, 20U, 24U, 32U, 48U, 64U};

if((canfdDataSize[0U] == dataSize) ||
(canfdDataSize[1U] == dataSize) ||
(canfdDataSize[2U] == dataSize) ||
(canfdDataSize[3U] == dataSize) ||
(canfdDataSize[4U] == dataSize) ||
(canfdDataSize[5U] == dataSize) ||
(canfdDataSize[6U] == dataSize) ||
(canfdDataSize[7U] == dataSize) ||
(canfdDataSize[8U] == dataSize) ||
(canfdDataSize[9U] == dataSize) ||
(canfdDataSize[10U] == dataSize) ||
(canfdDataSize[11U] == dataSize) ||
(canfdDataSize[12U] == dataSize) ||
(canfdDataSize[13U] == dataSize) ||
(canfdDataSize[14U] == dataSize) ||
(canfdDataSize[15U] == dataSize))
{
return SystemP_SUCCESS;
}

return SystemP_FAILURE;
}

8 months ago

0 Aswathi R 8 months ago

TI__Intellectual 1180 points

Hello Davide,

This is a valid issue and was fixed in the latest SDK release 11.00. Can you please upgrade to the latest SDK and try?

Best Regards,
Aswathi

0 Davide Pagliai 8 months ago in reply to Aswathi R

Prodigy 40 points

Hi Aswathi,
SDK release11.0 has not been released for the AM263x yet. The most recent available version is 10.02.00.13 (MCU+ SDK for AM263x).

Best regards,
Davide

+1 Aswathi R 8 months ago in reply to Davide Pagliai

TI__Intellectual 1180 points

Hi Davide,

Please use this link to download: https://www.ti.com/tool/download/MCU-PLUS-SDK-AM263X/11.00.00.19

I will check why it is not showing up on dev.ti.com and get back to you.

Best Regards,
Aswathi

0 Davide Pagliai 8 months ago in reply to Aswathi R

Prodigy 40 points

Hi Aswathi,
SDK release11.0 seems to be incompatible with CCS 20.3.1.

At the end of build I get the following error:

[106]node:internal/modules/cjs/loader:1078
[107] throw err;
[108] ^

[109]Error: Cannot find module 'C:\ti\mcu_plus_sdk_am263x_11_00_00_19\tools\boot\out2rprc\elf2rprc.js'
[110] at Module._resolveFilename (node:internal/modules/cjs/loader:1075:15)
[111] at Module._load (node:internal/modules/cjs/loader:920:27)
[112] at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)
[113] at node:internal/main/run_main_module:23:47 {
[114] code: 'MODULE_NOT_FOUND',
[115] requireStack: []
[116]}

[117]Node.js v18.16.0
[118]gmake[3]: *** [makefile_ccs_bootimage_gen:88: all] Error 1
[119]gmake[2]: [makefile:168: post-build] Error 2 (ignored)

Could you provide a migration procedure from SDK release 10 to release 11?

Best regards,
Davide

0 Aswathi R 8 months ago in reply to Davide Pagliai

TI__Intellectual 1180 points

Hi,
Can you tell me what example is this and if you have made any modifications to the makefile_ccs_bootimage_gen file? From the error log I see that it is trying to read the elf2rprpc.js file but we have deprecated all RPRC tools from SDK 11.00 as captured in the release notes: https://software-dl.ti.com/mcu-plus-sdk/esd/AM263X/11_00_00_19/exports/docs/api_guide_am263x/RELEASE_NOTES_11_00_00_PAGE.html

Best Regards,
Aswathi

0 Davide Pagliai 8 months ago in reply to Aswathi R

Prodigy 40 points

Hi Aswathi,
after installing the new SDK release, I just changed the product dependencies in the example project (canfd_external_read_write_am263x-cc_r5fss0-0_nortos_ti-arm-clang) and tried to build.

Please provide a procedure for migrating projects from version 10 of the SDK to version 11.

Best regards,

Davide

0 Aswathi R 8 months ago in reply to Davide Pagliai

TI__Intellectual 1180 points

Hi Davide,

Is this screenshot before updating or after? Because I see the products are outdated. Sysconfig version needs to be 1.25 and MCU+ SDK needs to be 11.00.00
Please confirm if you have downloaded these latest tools: https://software-dl.ti.com/mcu-plus-sdk/esd/AM263X/latest/exports/docs/api_guide_am263x/RELEASE_NOTES_11_00_00_PAGE.html#autotoc_md436

Best Regards,
Aswathi

0 Davide Pagliai 8 months ago in reply to Aswathi R

Prodigy 40 points

Hi Aswathi,
it is the screen before updating. I downloaded the latest tool and updated Sysconfig to version 1.25, MCU+ SDK to version 11.00.00 and the compiler TI Clang to version 4.0.3 LTS.

Best regards,

Davide