summaryrefslogtreecommitdiffstats
path: root/utils/wview/patches/050-WMRUSB-fix-segfault-buffer-overflow.patch
blob: be518c608b01d3814b07ecda3b69dc6163e35d24 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Index: wview-5.19.0-jgoerzen/stations/WMRUSB/wmrusbprotocol.c
===================================================================
--- wview-5.19.0-jgoerzen.orig/stations/WMRUSB/wmrusbprotocol.c	2013-03-10 22:24:28.000000000 +0400
+++ wview-5.19.0-jgoerzen/stations/WMRUSB/wmrusbprotocol.c	2013-03-10 22:25:01.000000000 +0400
@@ -897,8 +897,11 @@
 // Read raw USB data and buffer it for later processing:
 void wmrReadData (WVIEWD_WORK *work, WMRUSB_MSG_DATA* msg)
 {
-    memcpy(&wmrWork.readData[wmrWork.readIndex], msg->data, msg->length);
-    wmrWork.readIndex += msg->length;
+    if (wmrWork.readIndex + msg->length <= WMR_BUFFER_LENGTH)
+    {
+        memcpy(&wmrWork.readData[wmrWork.readIndex], msg->data, msg->length);
+        wmrWork.readIndex += msg->length;
+    }
 
     return;
 }