Module: xenomai-2.5 Branch: master Commit: 89c98166b1fe4c62f043c8c795dcad6f020c451a URL: http://git.xenomai.org/?p=xenomai-2.5.git;a=commit;h=89c98166b1fe4c62f043c8c795dcad6f020c451a
Author: Alexis Berlemont <alexis.berlem...@gmail.com> Date: Mon Jun 28 00:35:30 2010 +0200 analogy: fix a bug in a4l_fill_desc() when called on an idle device If we open an unattached device (thanks to a4l_open), the descriptor field "sbsize" is worth 0. Before calling a4l_fill_desc, we need to allocate a memory area so as to hold the device info data. According to the manual page, malloc(0) does not have to return NULL. It can return a pointer. So, we call a4l_fill_desc without any allocated memory area. As there was no proper checking test in a4l_fill_desc, there was a memory corruption bug. --- src/drvlib/analogy/descriptor.c | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/src/drvlib/analogy/descriptor.c b/src/drvlib/analogy/descriptor.c index a7addc0..6737265 100644 --- a/src/drvlib/analogy/descriptor.c +++ b/src/drvlib/analogy/descriptor.c @@ -229,6 +229,8 @@ static int __a4l_fill_desc(int fd, a4l_desc_t * dsc) * pass argument should be checked; check also the kernel log * ("dmesg") * - -EFAULT is returned if a user <-> kernel transfer went wrong + * - -ENODEV is returned if the descriptor is incoherent (the device + * may be unattached) * */ @@ -251,6 +253,11 @@ int a4l_sys_desc(int fd, a4l_desc_t * dsc, int pass) dsc->magic = MAGIC_BSC_DESC; } else { + if (!dsc->sbsize) { + ret = -ENODEV; + goto out_a4l_sys_desc; + } + ret = __a4l_fill_desc(fd, dsc); if (ret < 0) goto out_a4l_sys_desc; @@ -350,6 +357,8 @@ int a4l_close(a4l_desc_t * dsc) * the dsc pointer should be checked; check also the kernel log * ("dmesg") * - -EFAULT is returned if a user <-> kernel transfer went wrong + * - -ENODEV is returned if the descriptor is incoherent (the device + * may be unattached) * */ int a4l_fill_desc(a4l_desc_t * dsc) _______________________________________________ Xenomai-git mailing list Xenomai-git@gna.org https://mail.gna.org/listinfo/xenomai-git