]> sigrok.org Git - libsigrok.git/commit - src/hardware/asix-sigma/protocol.c
asix-sigma: fix buffer length check in register write helper
authorGerhard Sittig <redacted>
Sun, 16 Oct 2016 16:25:21 +0000 (18:25 +0200)
committerUwe Hermann <redacted>
Mon, 17 Oct 2016 00:05:22 +0000 (02:05 +0200)
commit7c86d8537204caa95d70d92bf5698b32ac35fa10
tree1be0a99346f3e72dea8d7aceb3d3746b5d3ace1d
parent2f7e529ce64c45508adf616b4b48a7a154aa7798
asix-sigma: fix buffer length check in register write helper

Fix the array size check in the sigma_write_register() routine. The
'len' parameter specifies the number of bytes to write, while the 'buf'
array holds one nibble per array item.

The previous implementation (commit e8686e3ae36c1) switched to a
constant size and made the buffer large enough so that no existing
request would exceed the buffer, fixing an overflow that was present
before that commit. But the most recent size check was incomplete and
might erroneously succeed for larger amounts of write data.

It's assumed that the issue which gets addressed here never occured in
practice. The constant-size buffer could hold up to 39 bytes of input
data in their transport representation, while the largest data that was
passed to the write routine is six bytes (trigger LUT params).

Fixes: e8686e3ae36c1 "asix-sigma: Avoid use of variable length arrays"
Signed-off-by: Gerhard Sittig <redacted>
src/hardware/asix-sigma/protocol.c