Skip to content

Buffer Overrun response may not be sent on expedited download requests #4

Description

@msftrncs

i := 0;
WHILE i < Request_LEN DO
IF i >= Response_BUFFER_LEN THEN
EXIT;
END_IF
Response_BUFFER_PTR^[i] := CANSDO_DATA[i + 4]; (* copy data *)
i := i + 1;
END_WHILE
Request_LEN := i; (* length of data downloaded *)
(* if request length was known, then its a problem if there was more data than buffer, but not if length was not known *)
Request_BUFFEROVERRUN := SEL( Request_LEN_KNOWN, FALSE, i > Response_BUFFER_LEN );

The expression for Request_BUFFEROVERRUN may never be set because i will not exceed Response_BUFFER_LEN when the WHILE loop exits upon detecting that the supplied buffer has been filled to capacity.

The correction requires rearranging lines (382-384):

		(* if request length was known, then its a problem if there was more data than buffer, but not if length was not known *)
		Request_BUFFEROVERRUN := SEL( Request_LEN_KNOWN, FALSE, Request_LEN > Response_BUFFER_LEN );
		IF Request_BUFFEROVERRUN THEN
			Request_LEN := i; (* length of data downloaded *)
		END_IF

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions