aboutsummaryrefslogtreecommitdiffstats
path: root/o3000_xfer_handler.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--o3000_xfer_handler.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/o3000_xfer_handler.c b/o3000_xfer_handler.c
index 0d3897b..d0cc73b 100644
--- a/o3000_xfer_handler.c
+++ b/o3000_xfer_handler.c
@@ -150,6 +150,15 @@ void handle_transfer(struct o3000_session_t *session, uint8_t *addr, int len) {
* to the video cache.
*/
wraparound_chunk_size = session->frame_size - (session->frame_buf - session->frame_start);
+ if(wraparound_chunk_size < 0 || wraparound_chunk_size > MAX_IMAGE_SIZE) {
+ /*
+ * Paranoia check:
+ * Ensure that the wraparound_chunk_size is always positive and does not exceed the end of the frame_buf.
+ * (Cases were noticed where the wraparound_chunk_size becomes negative.)
+ */
+ session->frame_state = IMG_FRAME_STATE_NOSYNC;
+ return;
+ }
o3000_log(session, O3000_LOG_DEBUG, "%s: wrap-around, copy %d bytes to frame buffer\n", __func__, wraparound_chunk_size);
memcpy(session->frame_buf, session->video_cache, wraparound_chunk_size);
}