Date: Thu, 17 Apr 2003 00:35:36 +0200 From: "Daan Vreeken [PA4DAN]" <Danovitsch@Vitsch.net> To: FreeBSD-gnats-submit@FreeBSD.org Cc: Danovitsch@Vitsch.net Subject: kern/51074: pointer arithmatic error in ugen.c Message-ID: <200304170035.36043.Danovitsch@Vitsch.net> Resent-Message-ID: <200304162240.h3GMe5IB080953@freefall.freebsd.org>
index | next in thread | raw e-mail
Note: There was a bad value `no=20' for the field `>Confidential:'.
It was set to the default value of `yes'.
>Number: 51074
>Category: kern
>Synopsis: pointer arithmatic error in ugen.c
>Confidential: yes
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Apr 16 15:40:05 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator: Daan Vreeken [PA4DAN]
>Release: FreeBSD 5.0
>Organization:
none
>Environment:
System: FreeBSD 5.0 (and all others I checked)
>Description:
I believe there is a pointer arithmatic error in line 965 of ugen.c .
The entire piece of code reads :
961: /* throw away oldest input if the buffer is full */
962: if(sce->fill < sce->cur && sce->cur <=3D sce->fill + count) {
963: sce->cur +=3D count;
964: if(sce->cur >=3D sce->limit)
965: sce->cur =3D sce->ibuf + (sce->limit - sce->cur);
966: DPRINTFN(5, ("ugen_isoc_rintr: throwing away %d bytes\n",
967: count));
978: }
count gets added to sce->cur .
if the pointer equals/exceeds the end of the buffer, we move it to the
beginnen of the buffer (plus the X bytes it was past the end).
If sce->cur exceeds sce->limit, (sce->cur - sce->limit) would be a negati=
ve
value. (resulting in a sce->cur pointer sitting X bytes before the beginn=
ing
of the buffer)
>How-To-Repeat:
n/a
>Fix:
--- ugen.c.diff begins here ---
965c965
< sce->cur =3D sce->ibuf + (sce->limit - sce->cur);
---
> sce->cur =3D sce->ibuf + (sce->cur - sce->limit);
--- ugen.c.diff ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted:
help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200304170035.36043.Danovitsch>