From: Ian Abbott <abbotti@mev.co.uk>
Date: Mon, 27 Jun 2011 12:03:03 +0000 (+0100)
Subject: comedi_test: Fix buffer overrun in test_mmap()
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=261d3e102945bf1389360bf5fb19142c9453f491;p=comedilib.git

comedi_test: Fix buffer overrun in test_mmap()

If the command does not stop immediately after the last sample, there
can be more data to read than we have room for.  Make sure the 'while'
loop 'read()' does not overrun the end of the malloc'ed 'buf'.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---

diff --git a/testing/mmap.c b/testing/mmap.c
index 96e047b..deb95e5 100644
--- a/testing/mmap.c
+++ b/testing/mmap.c
@@ -113,7 +113,8 @@ int test_mmap(void)
 	go=1;
 	b=buf;
 	while(go){
-		ret = read(comedi_fileno(device), b, N_SAMPLES * sample_size);
+		ret = read(comedi_fileno(device), b,
+				(N_SAMPLES * sample_size) - total);
 		if(ret<0){
 			if(errno==EAGAIN){
 				usleep(10000);
@@ -127,6 +128,9 @@ int test_mmap(void)
 			total += ret;
 			b += ret;
 			if(verbose) printf("read %d %d\n",ret,total);
+			if(total >= (N_SAMPLES * sample_size)){
+				go = 0;
+			}
 		}
 	}