From: Martin Ling <redacted>
Date: Tue, 13 Oct 2015 14:04:03 +0000 (+0100)
Subject: sp_wait: Avoid overflow of timeout parameter to poll().
X-Git-Tag: libserialport-0.1.1~10
X-Git-Url: http://sigrok.org/gitweb/?p=libserialport.git;a=commitdiff_plain;h=127d8d0ce7901d87b636efb8f865e80d3d2f08b4

sp_wait: Avoid overflow of timeout parameter to poll().
---

diff --git a/libserialport_internal.h b/libserialport_internal.h
index a5fc7bc..a0d872b 100644
--- a/libserialport_internal.h
+++ b/libserialport_internal.h
@@ -35,6 +35,7 @@
 #include <errno.h>
 #include <stdio.h>
 #include <stdarg.h>
+#include <limits.h>
 #ifdef _WIN32
 #include <windows.h>
 #include <tchar.h>
diff --git a/serialport.c b/serialport.c
index 7b45229..2f7618e 100644
--- a/serialport.c
+++ b/serialport.c
@@ -1421,7 +1421,9 @@ SP_API enum sp_return sp_wait(struct sp_event_set *event_set,
 	RETURN_OK();
 #else
 	struct timeval start, delta, now, end = {0, 0};
-	int started = 0;
+	const struct timeval max_delta = {
+		(INT_MAX / 1000), (INT_MAX % 1000) * 1000};
+	int started = 0, timeout_overflow = 0;
 	int result, timeout_remaining_ms;
 	struct pollfd *pollfds;
 	unsigned int i;
@@ -1461,7 +1463,8 @@ SP_API enum sp_return sp_wait(struct sp_event_set *event_set,
 		if (!timeout_ms) {
 			timeout_remaining_ms = -1;
 		} else if (!started) {
-			timeout_remaining_ms = timeout_ms;
+			timeout_overflow = (timeout_ms > INT_MAX);
+			timeout_remaining_ms = timeout_overflow ? INT_MAX : timeout_ms;
 		} else {
 			gettimeofday(&now, NULL);
 			if (timercmp(&now, &end, >)) {
@@ -1469,6 +1472,8 @@ SP_API enum sp_return sp_wait(struct sp_event_set *event_set,
 				break;
 			}
 			timersub(&end, &now, &delta);
+			if ((timeout_overflow = timercmp(&delta, &max_delta, >)))
+				delta = max_delta;
 			timeout_remaining_ms = delta.tv_sec * 1000 + delta.tv_usec / 1000;
 		}
 
@@ -1485,7 +1490,8 @@ SP_API enum sp_return sp_wait(struct sp_event_set *event_set,
 			}
 		} else if (result == 0) {
 			DEBUG("poll() timed out");
-			break;
+			if (!timeout_overflow)
+				break;
 		} else {
 			DEBUG("poll() completed");
 			break;