From owner-freebsd-bugs@FreeBSD.ORG Sun Apr 20 07:50:17 2003 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2B60C37B401 for ; Sun, 20 Apr 2003 07:50:17 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id CE23843FE1 for ; Sun, 20 Apr 2003 07:50:15 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id h3KEoFUp041461 for ; Sun, 20 Apr 2003 07:50:15 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.9/8.12.9/Submit) id h3KEoFB5041460; Sun, 20 Apr 2003 07:50:15 -0700 (PDT) Resent-Date: Sun, 20 Apr 2003 07:50:15 -0700 (PDT) Resent-Message-Id: <200304201450.h3KEoFB5041460@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, "Daan Vreeken [PA4DAN]" Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3288837B401 for ; Sun, 20 Apr 2003 07:48:34 -0700 (PDT) Received: from Vitsch.net (b83007.upc-b.chello.nl [212.83.83.7]) by mx1.FreeBSD.org (Postfix) with ESMTP id 76DF343FAF for ; Sun, 20 Apr 2003 07:48:32 -0700 (PDT) (envelope-from pa4dan@vitsch.net) Received: from vitsch.net (localhost [127.0.0.1])h3GHpdh7002060; Wed, 16 Apr 2003 19:51:39 +0200 (CEST) (envelope-from pa4dan@vitsch.net) Received: (from pa4dan@localhost) by vitsch.net (8.12.6/8.12.6/Submit) id h3GHpcw6002059; Wed, 16 Apr 2003 19:51:38 +0200 (CEST) Message-Id: <200304161751.h3GHpcw6002059@vitsch.net> Date: Wed, 16 Apr 2003 19:51:38 +0200 (CEST) From: "Daan Vreeken [PA4DAN]" To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 cc: Danovitsch@vitsch.net Subject: kern/51186: pointer arithmatic error in ugen.c X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Daan Vreeken \[PA4DAN\]" List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Apr 2003 14:50:17 -0000 >Number: 51186 >Category: kern >Synopsis: pointer arithmatic error in ugen.c >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Apr 20 07:50:14 PDT 2003 >Closed-Date: >Last-Modified: >Originator: Daan Vreeken [PA4DAN] >Release: FreeBSD 5.0 >Organization: none >Environment: System: FreeBSD 5.0 (and all others I checked) >Description: I believe there is a pointer arithmatic error in line 965 of ugen.c . The entire piece of code reads : 961: /* throw away oldest input if the buffer is full */ 962: if(sce->fill < sce->cur && sce->cur <= sce->fill + count) { 963: sce->cur += count; 964: if(sce->cur >= sce->limit) 965: sce->cur = sce->ibuf + (sce->limit - sce->cur); 966: DPRINTFN(5, ("ugen_isoc_rintr: throwing away %d bytes\n", 967: count)); 978: } count gets added to sce->cur . if the pointer equals/exceeds the end of the buffer, we move it to the beginnen of the buffer (plus the X bytes it was past the end). If sce->cur exceeds sce->limit, (sce->cur - sce->limit) would be a negative value. (resulting in a sce->cur pointer sitting X bytes before the beginning of the buffer) >How-To-Repeat: n/a >Fix: --- ugen.c.diff begins here --- 965c965 < sce->cur = sce->ibuf + (sce->limit - sce->cur); --- > sce->cur = sce->ibuf + (sce->cur - sce->limit); --- ugen.c.diff ends here --- >Release-Note: >Audit-Trail: >Unformatted: