jcs
/subtext
/amendments
/618
serial: Off-by-ones
jcs made amendment 618 11 months ago
--- serial.c Fri Jan 19 10:57:11 2024
+++ serial.c Thu Dec 11 17:46:31 2025
@@ -365,7 +365,8 @@ maybe_read:
return NULL;
}
if (len) {
- len = MIN(len, sizeof(serial_input_buf) - serial_input_buf_len);
+ len = MIN(len, sizeof(serial_input_buf) -
+ serial_input_buf_len - 1);
FSRead(serial_in_refnum, &len,
serial_input_buf + serial_input_buf_len);
serial_input_buf[serial_input_buf_len + len] = '\0';
@@ -406,7 +407,7 @@ find_line:
}
if (wait) {
- if (serial_input_buf_len >= sizeof(serial_input_buf))
+ if (serial_input_buf_len > sizeof(serial_input_buf))
panic("serial_get_line with wait but input buffer full");
if (Time - started > 5) {
logger_printf("[modem] Timed out waiting for modem response");
@@ -604,7 +605,7 @@ serial_output(struct session *session)
if (Time - the_serial_node.write_timeout_since >=
SERIAL_WRITE_GIVE_UP) {
- logger_printf("[modem] Reached %d seconds of write timeouts, "
+ logger_printf("[modem] Reached %lu seconds of write timeouts, "
"hanging up", Time - the_serial_node.write_timeout_since);
session->ending = true;
}
@@ -613,9 +614,11 @@ serial_output(struct session *session)
}
the_serial_node.write_timeout_since = 0;
- if (serial_write_pbr.ioParam.ioReqCount > session->obuflen)
+ if (serial_write_pbr.ioParam.ioReqCount > session->obuflen) {
warn("serial wrote more than obuflen?");
- session->obuflen -= serial_write_pbr.ioParam.ioReqCount;
+ session->obuflen = 0;
+ } else
+ session->obuflen -= serial_write_pbr.ioParam.ioReqCount;
session_check_buf_canaries(session);
return serial_write_pbr.ioParam.ioReqCount;