added code of buffer overflow. The async acquision stops as soon
authorBernd Porr <Bernd.Porr@f2s.com>
Sun, 24 May 2009 18:51:39 +0000 (18:51 +0000)
committerBernd Porr <Bernd.Porr@f2s.com>
Sun, 24 May 2009 18:51:39 +0000 (18:51 +0000)
as there's a buffer overflow.

comedi/drivers/usbdux.c
comedi/drivers/usbduxfast.c

index e9981b5fab936a70dce217199364d22774f09fa7..cd71316f23668e430171009a618c233971c00e42 100644 (file)
@@ -522,15 +522,20 @@ static void usbduxsub_ai_IsocIrq(struct urb *urb PT_REGS_ARG)
        for (i = 0; i < n; i++) {
                // transfer data
                if (CR_RANGE(s->async->cmd.chanlist[i]) <= 1) {
-                       comedi_buf_put
+                       err = comedi_buf_put
                                (s->async,
-                               le16_to_cpu(this_usbduxsub->
-                                       inBuffer[i]) ^ 0x800);
+                                le16_to_cpu(this_usbduxsub->
+                                            inBuffer[i]) ^ 0x800);
                } else {
-                       comedi_buf_put
+                       err = comedi_buf_put
                                (s->async,
-                               le16_to_cpu(this_usbduxsub->inBuffer[i]));
+                                le16_to_cpu(this_usbduxsub->inBuffer[i]));
                }
+               if (unlikely(err == 0)) {
+                       /* buffer overflow */
+                       usbdux_ai_stop(this_usbduxsub, 0);
+                       return;
+               }       
        }
        // tell comedi that data is there
        comedi_event(this_usbduxsub->comedidev, s);
index 0d21323e9d35253ec9bd0ea72d8c8c0638d24300..9115e6e1febc15a5ad84606be382ab5bc2bbfa7e 100644 (file)
@@ -392,8 +392,14 @@ static void usbduxfastsub_ai_Irq(struct urb *urb PT_REGS_ARG)
                        this_usbduxfastsub->ai_sample_count -= n;
                }
                // write the full buffer to comedi
-               cfc_write_array_to_buffer(s,
-                       urb->transfer_buffer, urb->actual_length);
+               err = cfc_write_array_to_buffer(s,
+                                               urb->transfer_buffer, urb->actual_length);
+
+               if (unlikely(err == 0)) {
+                       /* buffer overflow */
+                       usbduxfast_ai_stop(this_usbduxfastsub, 0);
+                       return;
+               }
 
                // tell comedi that data is there
                comedi_event(this_usbduxfastsub->comedidev, s);