@@ -470,7 +470,7 @@ void PacketBuffer::AddRef()
470
470
#endif // !CHIP_SYSTEM_CONFIG_USE_LWIP
471
471
}
472
472
473
- PacketBufferHandle PacketBufferHandle::New (size_t aAvailableSize, uint16_t aReservedSize)
473
+ PacketBufferHandle PacketBufferHandle::New (size_t aAvailableSize, uint16_t aReservedSize, bool aIsLarge )
474
474
{
475
475
// Adding three 16-bit-int sized numbers together will never overflow
476
476
// assuming int is at least 32 bits.
@@ -488,7 +488,14 @@ PacketBufferHandle PacketBufferHandle::New(size_t aAvailableSize, uint16_t aRese
488
488
489
489
CHIP_SYSTEM_FAULT_INJECT (FaultInjection::kFault_PacketBufferNew , return PacketBufferHandle ());
490
490
491
- if (aAvailableSize > UINT16_MAX || lAllocSize > PacketBuffer::kMaxSizeWithoutReserve || lBlockSize > UINT16_MAX)
491
+ #if INET_CONFIG_ENABLE_TCP_ENDPOINT
492
+ if (aIsLarge && lAllocSize > CHIP_CONFIG_LARGE_PAYLOAD_MAX_SIZE)
493
+ {
494
+ ChipLogError (chipSystemLayer, " PacketBuffer: allocation too large." );
495
+ return PacketBufferHandle ();
496
+ }
497
+ #endif // INET_CONFIG_ENABLE_TCP_ENDPOINT
498
+ if (!aIsLarge && (aAvailableSize > UINT16_MAX || lAllocSize > PacketBuffer::kMaxSizeWithoutReserve || lBlockSize > UINT16_MAX))
492
499
{
493
500
ChipLogError (chipSystemLayer, " PacketBuffer: allocation too large." );
494
501
return PacketBufferHandle ();
@@ -548,16 +555,17 @@ PacketBufferHandle PacketBufferHandle::New(size_t aAvailableSize, uint16_t aRese
548
555
}
549
556
550
557
PacketBufferHandle PacketBufferHandle::NewWithData (const void * aData, size_t aDataSize, uint16_t aAdditionalSize,
551
- uint16_t aReservedSize)
558
+ uint16_t aReservedSize, bool aIsLarge )
552
559
{
553
- if (aDataSize > UINT16_MAX)
560
+ bool isOutOfSizeBounds = (aIsLarge ? aDataSize > UINT32_MAX : aDataSize > UINT16_MAX);
561
+ if (isOutOfSizeBounds)
554
562
{
555
563
ChipLogError (chipSystemLayer, " PacketBuffer: allocation too large." );
556
564
return PacketBufferHandle ();
557
565
}
558
566
// Since `aDataSize` fits in uint16_t, the sum `aDataSize + aAdditionalSize` will not overflow.
559
567
// `New()` will only return a non-null buffer if the total allocation size does not overflow.
560
- PacketBufferHandle buffer = New (aDataSize + aAdditionalSize, aReservedSize);
568
+ PacketBufferHandle buffer = New (aDataSize + aAdditionalSize, aReservedSize, aIsLarge );
561
569
if (buffer.mBuffer != nullptr )
562
570
{
563
571
memcpy (buffer.mBuffer ->payload , aData, aDataSize);
@@ -671,7 +679,7 @@ PacketBufferHandle PacketBufferHandle::PopHead()
671
679
return PacketBufferHandle (head);
672
680
}
673
681
674
- PacketBufferHandle PacketBufferHandle::CloneData () const
682
+ PacketBufferHandle PacketBufferHandle::CloneData (bool aIsLarge ) const
675
683
{
676
684
PacketBufferHandle cloneHead;
677
685
@@ -680,7 +688,17 @@ PacketBufferHandle PacketBufferHandle::CloneData() const
680
688
uint16_t originalDataSize = original->MaxDataLength ();
681
689
uint16_t originalReservedSize = original->ReservedSize ();
682
690
683
- if (originalDataSize + originalReservedSize > PacketBuffer::kMaxSizeWithoutReserve )
691
+ #if INET_CONFIG_ENABLE_TCP_ENDPOINT
692
+ // If buffer is intended to be large, check against max size for large
693
+ // allocations.
694
+ if (aIsLarge && originalDataSize + originalReservedSize > CHIP_CONFIG_LARGE_PAYLOAD_MAX_SIZE)
695
+ {
696
+ return PacketBufferHandle ();
697
+ }
698
+ #endif // INET_CONFIG_ENABLE_TCP_ENDPOINT
699
+ // If buffer is not intended to be large, check against max size for
700
+ // packets meant to go over MRP.
701
+ if (!aIsLarge && originalDataSize + originalReservedSize > PacketBuffer::kMaxSizeWithoutReserve )
684
702
{
685
703
// The original memory allocation may have provided a larger block than requested (e.g. when using a shared pool),
686
704
// and in particular may have provided a larger block than we are able to request from PackBufferHandle::New().
@@ -694,7 +712,7 @@ PacketBufferHandle PacketBufferHandle::CloneData() const
694
712
originalDataSize = static_cast <uint16_t >(PacketBuffer::kMaxSizeWithoutReserve - originalReservedSize);
695
713
}
696
714
697
- PacketBufferHandle clone = PacketBufferHandle::New (originalDataSize, originalReservedSize);
715
+ PacketBufferHandle clone = PacketBufferHandle::New (originalDataSize, originalReservedSize, aIsLarge );
698
716
if (clone.IsNull ())
699
717
{
700
718
return PacketBufferHandle ();
0 commit comments