Perform test though FreeRTOS Ethernet handler

Author: Alexander Senier

examples/include/FreeRTOS-10.0.1/FreeRTOSIPConfig.h

@@ -10,5 +10,6 @@
 #define ipconfigUSE_DNS 0
 #define ipconfigUSE_TCP 0
 #define ipconfigREPLY_TO_INCOMING_PINGS 1
+#define ipconfigDRIVER_INCLUDED_RX_IP_CHECKSUM 1
 
 #endif // FREERTOS_IP_CONFIG_H

examples/include/FreeRTOS-10.0.1/semphr.h

@@ -5,7 +5,7 @@
 
 typedef QueueHandle_t SemaphoreHandle_t;
 
-#define xSemaphoreCreateCounting(m, i) (0)
+#define xSemaphoreCreateCounting(m, i) ((SemaphoreHandle_t *)1)
 #define xSemaphoreTake(s, t) (pdPASS)
 #define xSemaphoreTakeFromISR(s, h) (pdPASS)
 #define xSemaphoreGiveFromISR(s, h) (pdPASS)

examples/src/queue.c

@@ -25,7 +25,7 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, const void * const pv
 
 UBaseType_t uxQueueMessagesWaitingFromISR( const QueueHandle_t xQueue )                                                                                                       
 {
-   errx(1, "NOT IMPLEMENTED: %s", __func__);
+   return 256;
 }
 
 void vQueueDelete( QueueHandle_t xQueue )                                                                                                                                     

examples/src/vuln_75.c

@@ -1,26 +1,44 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <err.h>
+
 #include "FreeRTOS.h"
 #include "list.h"
 #include "task.h"
 #include "FreeRTOS_IP.h"
 #include "FreeRTOS_IP_Private.h"
+#include "NetworkBufferManagement.h"
 
-eFrameProcessingResult_t prvProcessICMPPacket( ICMPPacket_t * const pxICMPPacket );
+NetworkBufferDescriptor_t *network_buffer;
+void prvProcessEthernetPacket( NetworkBufferDescriptor_t * const pxNetworkBuffer );
 
 char data[] =
    // Ethernet header
-   "\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
+   "\x00\x00\x00\x00\x00\x00" // destination
+   "\x00\x00\x00\x00\x00\x00" // source
+   "\x08\x00"                 // ether type: IPv4
    // IP header
-   "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
+   "\x45"                     // Version / IHL
+   "\x00"                     // DCSP / ECN
+   "\x00\x21"                 // Total Length (21)
+   "\x00\x00"                 // Identification
+   "\x00\x00"                 // R / DF / MF / Fragment Offset
+   "\x00"                     // TTL
+   "\x01"                     // protocol: icmp (1)
+   "\x00\x00"                 // header checksum
+   "\x00\x00\x00\x00"         // source
+   "\x00\x00\x00\x00"         // destination
    // ICMP header
-   "\x8"    // Type of message -- echo request
-   // Leaving out subsequent fields results in a buffer overflow
-   // "\0"    // Type of service
-   // "\0\0"  // Checksum
-   // "\0\0"  // Identifier
-   // "\0\0"  // Sequence number
+   "\x08"                     // Type of message -- echo request
    ;
 
 int main()
 {
-   eFrameProcessingResult_t result = prvProcessICMPPacket ((ICMPPacket_t *)data);
+   if (xNetworkBuffersInitialise() != pdPASS) {
+      errx(1, "Error initializing network buffers");
+   }
+   network_buffer = pxNetworkBufferGetFromISR(1500);
+   network_buffer->xDataLength = sizeof(data);
+   network_buffer->pucEthernetBuffer = data;
+   prvProcessEthernetPacket (network_buffer);
 }