diff options
| author | Quentin Stafford-Fraser <quentin at pobox.com> | 2009-05-24 15:25:49 -0700 |
|---|---|---|
| committer | libdlo <libdlo@displaylink.com> | 2009-05-24 15:25:49 -0700 |
| commit | 3514139f84226a5a7d3898014ab0136401f000be (patch) | |
| tree | 993187a68350f1140160170dceb0131d116e06f1 | |
| parent | f4dca4f18883305df027b7c9e18e65a1419328ea (diff) | |
Fix buffer overflow in cmd_stripe24
Signed-off-by: Steve Revill <srevill@endurancetech.co.uk>
| -rw-r--r-- | src/dlo_grfx.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/dlo_grfx.c b/src/dlo_grfx.c index 3e9008a..cb0dd48 100644 --- a/src/dlo_grfx.c +++ b/src/dlo_grfx.c @@ -690,6 +690,10 @@ static dlo_retcode_t cmd_stripe24(dlo_device_t * const dev, dlo_ptr_t base16, dl *(dev->bufptr)++ = (char)(base16 & 0xFF);
*(dev->bufptr)++ = rem >= RAW_MAX_PIXELS ? 0 : rem;
+ /* Flush the command buffer if it's getting full */
+ if (dev->bufend - dev->bufptr - BYTES_PER_16BPP * RAW_MAX_PIXELS < BUF_HIGH_WATER_MARK)
+ ERR(dlo_usb_write(dev));
+
for (pix = 0; pix < (rem >= RAW_MAX_PIXELS ? RAW_MAX_PIXELS : rem); pix++)
{
dlo_col16_t col = *ptr_col16++;
@@ -711,6 +715,10 @@ static dlo_retcode_t cmd_stripe24(dlo_device_t * const dev, dlo_ptr_t base16, dl *(dev->bufptr)++ = (char)(base8 & 0xFF);
*(dev->bufptr)++ = rem >= RAW_MAX_PIXELS ? 0 : rem;
+ /* Flush the command buffer if it's getting full */
+ if (dev->bufend - dev->bufptr - BYTES_PER_8BPP * RAW_MAX_PIXELS < BUF_HIGH_WATER_MARK)
+ ERR(dlo_usb_write(dev));
+
for (pix = 0; pix < (rem >= RAW_MAX_PIXELS ? RAW_MAX_PIXELS : rem); pix++)
*(dev->bufptr)++ = (char)(*ptr_col8++);
|