diff options
Diffstat (limited to '')
| -rw-r--r-- | o3000_xfer_handler.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/o3000_xfer_handler.c b/o3000_xfer_handler.c index 0d3897b..d0cc73b 100644 --- a/o3000_xfer_handler.c +++ b/o3000_xfer_handler.c @@ -150,6 +150,15 @@ void handle_transfer(struct o3000_session_t *session, uint8_t *addr, int len) { * to the video cache.
*/
wraparound_chunk_size = session->frame_size - (session->frame_buf - session->frame_start);
+ if(wraparound_chunk_size < 0 || wraparound_chunk_size > MAX_IMAGE_SIZE) {
+ /*
+ * Paranoia check:
+ * Ensure that the wraparound_chunk_size is always positive and does not exceed the end of the frame_buf.
+ * (Cases were noticed where the wraparound_chunk_size becomes negative.)
+ */
+ session->frame_state = IMG_FRAME_STATE_NOSYNC;
+ return;
+ }
o3000_log(session, O3000_LOG_DEBUG, "%s: wrap-around, copy %d bytes to frame buffer\n", __func__, wraparound_chunk_size);
memcpy(session->frame_buf, session->video_cache, wraparound_chunk_size);
}
|