Don't exceed the maximum number of bytes.
We received data from a device where the end-of-profile marker is missing. Because the device fails to locate the last dive, it goes into an infinite loop, and keeps sending the same sequence of dives over and over again. As a result, we receive more data than expected, and the assert in the progress event is triggered. We now keep track of the maximum number of bytes remaining and abort once the limit is passed. The values of the progress events are capped at the maximum value to avoid the assertion.
This commit is contained in:
@@ -437,6 +437,8 @@ suunto_vyper_read_dive (device_t *abstract, dc_buffer_t *buffer, int init, devic
|
|||||||
// Update and emit a progress event.
|
// Update and emit a progress event.
|
||||||
if (progress) {
|
if (progress) {
|
||||||
progress->current += len;
|
progress->current += len;
|
||||||
|
if (progress->current > progress->maximum)
|
||||||
|
progress->current = progress->maximum;
|
||||||
device_event_emit (abstract, DEVICE_EVENT_PROGRESS, progress);
|
device_event_emit (abstract, DEVICE_EVENT_PROGRESS, progress);
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -554,10 +556,17 @@ suunto_vyper_device_foreach (device_t *abstract, dive_callback_t callback, void
|
|||||||
return DEVICE_STATUS_MEMORY;
|
return DEVICE_STATUS_MEMORY;
|
||||||
|
|
||||||
unsigned int ndives = 0;
|
unsigned int ndives = 0;
|
||||||
|
unsigned int remaining = layout->rb_profile_end - layout->rb_profile_begin;
|
||||||
while ((rc = suunto_vyper_read_dive (abstract, buffer, (ndives == 0), &progress)) == DEVICE_STATUS_SUCCESS) {
|
while ((rc = suunto_vyper_read_dive (abstract, buffer, (ndives == 0), &progress)) == DEVICE_STATUS_SUCCESS) {
|
||||||
unsigned char *data = dc_buffer_get_data (buffer);
|
unsigned char *data = dc_buffer_get_data (buffer);
|
||||||
unsigned int size = dc_buffer_get_size (buffer);
|
unsigned int size = dc_buffer_get_size (buffer);
|
||||||
|
|
||||||
|
if (size > remaining) {
|
||||||
|
WARNING ("Unexpected number of bytes received.");
|
||||||
|
dc_buffer_free (buffer);
|
||||||
|
return DEVICE_STATUS_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
if (size == 0) {
|
if (size == 0) {
|
||||||
dc_buffer_free (buffer);
|
dc_buffer_free (buffer);
|
||||||
return DEVICE_STATUS_SUCCESS;
|
return DEVICE_STATUS_SUCCESS;
|
||||||
@@ -573,6 +582,7 @@ suunto_vyper_device_foreach (device_t *abstract, dive_callback_t callback, void
|
|||||||
return DEVICE_STATUS_SUCCESS;
|
return DEVICE_STATUS_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
remaining -= size;
|
||||||
ndives++;
|
ndives++;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user