AmendHub

Download (as of this amendment):

jcs

/

subtext

/

amendments

/

618

serial: Off-by-ones


jcs made amendment 618 11 months ago
--- serial.c Fri Jan 19 10:57:11 2024 +++ serial.c Thu Dec 11 17:46:31 2025 @@ -365,7 +365,8 @@ maybe_read: return NULL; } if (len) { - len = MIN(len, sizeof(serial_input_buf) - serial_input_buf_len); + len = MIN(len, sizeof(serial_input_buf) - + serial_input_buf_len - 1); FSRead(serial_in_refnum, &len, serial_input_buf + serial_input_buf_len); serial_input_buf[serial_input_buf_len + len] = '\0'; @@ -406,7 +407,7 @@ find_line: } if (wait) { - if (serial_input_buf_len >= sizeof(serial_input_buf)) + if (serial_input_buf_len > sizeof(serial_input_buf)) panic("serial_get_line with wait but input buffer full"); if (Time - started > 5) { logger_printf("[modem] Timed out waiting for modem response"); @@ -604,7 +605,7 @@ serial_output(struct session *session) if (Time - the_serial_node.write_timeout_since >= SERIAL_WRITE_GIVE_UP) { - logger_printf("[modem] Reached %d seconds of write timeouts, " + logger_printf("[modem] Reached %lu seconds of write timeouts, " "hanging up", Time - the_serial_node.write_timeout_since); session->ending = true; } @@ -613,9 +614,11 @@ serial_output(struct session *session) } the_serial_node.write_timeout_since = 0; - if (serial_write_pbr.ioParam.ioReqCount > session->obuflen) + if (serial_write_pbr.ioParam.ioReqCount > session->obuflen) { warn("serial wrote more than obuflen?"); - session->obuflen -= serial_write_pbr.ioParam.ioReqCount; + session->obuflen = 0; + } else + session->obuflen -= serial_write_pbr.ioParam.ioReqCount; session_check_buf_canaries(session); return serial_write_pbr.ioParam.ioReqCount;