From 261d3e102945bf1389360bf5fb19142c9453f491 Mon Sep 17 00:00:00 2001 From: Ian Abbott Date: Mon, 27 Jun 2011 13:03:03 +0100 Subject: [PATCH] comedi_test: Fix buffer overrun in test_mmap() If the command does not stop immediately after the last sample, there can be more data to read than we have room for. Make sure the 'while' loop 'read()' does not overrun the end of the malloc'ed 'buf'. Signed-off-by: Ian Abbott --- testing/mmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/testing/mmap.c b/testing/mmap.c index 96e047b..deb95e5 100644 --- a/testing/mmap.c +++ b/testing/mmap.c @@ -113,7 +113,8 @@ int test_mmap(void) go=1; b=buf; while(go){ - ret = read(comedi_fileno(device), b, N_SAMPLES * sample_size); + ret = read(comedi_fileno(device), b, + (N_SAMPLES * sample_size) - total); if(ret<0){ if(errno==EAGAIN){ usleep(10000); @@ -127,6 +128,9 @@ int test_mmap(void) total += ret; b += ret; if(verbose) printf("read %d %d\n",ret,total); + if(total >= (N_SAMPLES * sample_size)){ + go = 0; + } } } -- 2.26.2