[Tinyos-2-commits] CVS: tinyos-2.x/tos/lib/printf PrintfP.nc, 1.6, 1.7

[Kevin Klues]

Update of /cvsroot/tinyos/tinyos-2.x/tos/lib/printf
In directory sc8-pr-cvs10.sourceforge.net:/tmp/cvs-serv30156

Modified Files:
	PrintfP.nc 
Log Message:
Error in length provided to memset, resulting in a buffer overflow.  Error now fixed.

Index: PrintfP.nc
===================================================================
RCS file: /cvsroot/tinyos/tinyos-2.x/tos/lib/printf/PrintfP.nc,v
retrieving revision 1.6
retrieving revision 1.7
diff -C2 -d -r1.6 -r1.7
*** PrintfP.nc	20 Apr 2007 01:14:13 -0000	1.6
--- PrintfP.nc	16 Jul 2007 19:42:34 -0000	1.7
***************
*** 85,92 ****
    
    void sendNext() {
!   	printf_msg_t* m = (printf_msg_t*)call Packet.getPayload(&printfMsg, NULL);
!   	length_to_send = (bytes_left_to_flush < sizeof(printf_msg_t)) ? bytes_left_to_flush : sizeof(printf_msg_t);
!   	memset(m->buffer, 0, sizeof(printfMsg));
!   	memcpy(m->buffer, (uint8_t*)next_byte, length_to_send);
      if(call AMSend.send(AM_BROADCAST_ADDR, &printfMsg, sizeof(printf_msg_t)) != SUCCESS)
        post retrySend();  
--- 85,92 ----
    
    void sendNext() {
!     printf_msg_t* m = (printf_msg_t*)call Packet.getPayload(&printfMsg, NULL);
!     length_to_send = (bytes_left_to_flush < sizeof(printf_msg_t)) ? bytes_left_to_flush : sizeof(printf_msg_t);
!     memset(m->buffer, 0, sizeof(m->buffer));
!     memcpy(m->buffer, (uint8_t*)next_byte, length_to_send);
      if(call AMSend.send(AM_BROADCAST_ADDR, &printfMsg, sizeof(printf_msg_t)) != SUCCESS)
        post retrySend();  
***************
*** 140,144 ****
    	  if(state == S_STARTED && (next_byte > buffer)) {
    	    state = S_FLUSHING;
!         bytes_left_to_flush = next_byte - buffer;
    	    next_byte = buffer;
    	  }
--- 140,144 ----
    	  if(state == S_STARTED && (next_byte > buffer)) {
    	    state = S_FLUSHING;
!             bytes_left_to_flush = next_byte - buffer;
    	    next_byte = buffer;
    	  }