Skip to content

Buffer Overrun response may not be sent on expedited download requests #4

@msftrncs

Description

@msftrncs

i := 0;
WHILE i < Request_LEN DO
IF i >= Response_BUFFER_LEN THEN
EXIT;
END_IF
Response_BUFFER_PTR^[i] := CANSDO_DATA[i + 4]; (* copy data *)
i := i + 1;
END_WHILE
Request_LEN := i; (* length of data downloaded *)
(* if request length was known, then its a problem if there was more data than buffer, but not if length was not known *)
Request_BUFFEROVERRUN := SEL( Request_LEN_KNOWN, FALSE, i > Response_BUFFER_LEN );

The expression for Request_BUFFEROVERRUN may never be set because i will not exceed Response_BUFFER_LEN when the WHILE loop exits upon detecting that the supplied buffer has been filled to capacity.

The correction requires rearranging lines (382-384):

		(* if request length was known, then its a problem if there was more data than buffer, but not if length was not known *)
		Request_BUFFEROVERRUN := SEL( Request_LEN_KNOWN, FALSE, Request_LEN > Response_BUFFER_LEN );
		IF Request_BUFFEROVERRUN THEN
			Request_LEN := i; (* length of data downloaded *)
		END_IF

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions