From 2487167778e40062cada3b78c12b3b6e048e29c4 Mon Sep 17 00:00:00 2001 From: Jef Driesen Date: Thu, 20 Sep 2012 23:08:22 +0200 Subject: [PATCH] Don't exceed the maximum number of bytes. We received data from a device where the end-of-profile marker is missing. Because the device fails to locate the last dive, it goes into an infinite loop, and keeps sending the same sequence of dives over and over again. As a result, we receive more data than expected, and the assert in the progress event is triggered. We now keep track of the maximum number of bytes remaining and abort once the limit is passed. The values of the progress events are capped at the maximum value to avoid the assertion. --- src/suunto_vyper.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/suunto_vyper.c b/src/suunto_vyper.c index 6cd9124..d2fd14a 100644 --- a/src/suunto_vyper.c +++ b/src/suunto_vyper.c @@ -437,6 +437,8 @@ suunto_vyper_read_dive (device_t *abstract, dc_buffer_t *buffer, int init, devic // Update and emit a progress event. if (progress) { progress->current += len; + if (progress->current > progress->maximum) + progress->current = progress->maximum; device_event_emit (abstract, DEVICE_EVENT_PROGRESS, progress); } @@ -554,10 +556,17 @@ suunto_vyper_device_foreach (device_t *abstract, dive_callback_t callback, void return DEVICE_STATUS_MEMORY; unsigned int ndives = 0; + unsigned int remaining = layout->rb_profile_end - layout->rb_profile_begin; while ((rc = suunto_vyper_read_dive (abstract, buffer, (ndives == 0), &progress)) == DEVICE_STATUS_SUCCESS) { unsigned char *data = dc_buffer_get_data (buffer); unsigned int size = dc_buffer_get_size (buffer); + if (size > remaining) { + WARNING ("Unexpected number of bytes received."); + dc_buffer_free (buffer); + return DEVICE_STATUS_ERROR; + } + if (size == 0) { dc_buffer_free (buffer); return DEVICE_STATUS_SUCCESS; @@ -573,6 +582,7 @@ suunto_vyper_device_foreach (device_t *abstract, dive_callback_t callback, void return DEVICE_STATUS_SUCCESS; } + remaining -= size; ndives++; }