diff options
author | Sophia Giannikakis <giannikakis@stettbacher.ch> | 2019-10-21 15:36:07 +0200 |
---|---|---|
committer | Sophia Giannikakis <giannikakis@stettbacher.ch> | 2019-10-21 15:36:07 +0200 |
commit | dcf473889815a80134719160503fe9dfe846ed2c (patch) | |
tree | 9f5419d1b91ce6e15e0ef4f0fb176cac504193f7 /o3000_xfer_handler.c | |
parent | windows instructions added (diff) | |
download | o3000-driver-dcf473889815a80134719160503fe9dfe846ed2c.tar.gz o3000-driver-dcf473889815a80134719160503fe9dfe846ed2c.zip |
video cache wrap-around check added
Diffstat (limited to 'o3000_xfer_handler.c')
-rw-r--r-- | o3000_xfer_handler.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/o3000_xfer_handler.c b/o3000_xfer_handler.c index 0d3897b..d0cc73b 100644 --- a/o3000_xfer_handler.c +++ b/o3000_xfer_handler.c @@ -150,6 +150,15 @@ void handle_transfer(struct o3000_session_t *session, uint8_t *addr, int len) { * to the video cache.
*/
wraparound_chunk_size = session->frame_size - (session->frame_buf - session->frame_start);
+ if(wraparound_chunk_size < 0 || wraparound_chunk_size > MAX_IMAGE_SIZE) {
+ /*
+ * Paranoia check:
+ * Ensure that the wraparound_chunk_size is always positive and does not exceed the end of the frame_buf.
+ * (Cases were noticed where the wraparound_chunk_size becomes negative.)
+ */
+ session->frame_state = IMG_FRAME_STATE_NOSYNC;
+ return;
+ }
o3000_log(session, O3000_LOG_DEBUG, "%s: wrap-around, copy %d bytes to frame buffer\n", __func__, wraparound_chunk_size);
memcpy(session->frame_buf, session->video_cache, wraparound_chunk_size);
}
|