From Danovitsch@Vitsch.net  Wed Apr 16 15:34:14 2003
Return-Path: <Danovitsch@Vitsch.net>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D2C0C37B401
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 16 Apr 2003 15:34:14 -0700 (PDT)
Received: from Danovitsch.dnsq.org (b74143.upc-b.chello.nl [212.83.74.143])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 1176F43F75
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 16 Apr 2003 15:34:13 -0700 (PDT)
	(envelope-from Danovitsch@Vitsch.net)
Received: from vitsch.net (b83007.upc-b.chello.nl [212.83.83.7])
	by Danovitsch.dnsq.org (8.12.3p2/8.11.3) with ESMTP id h3GMTBCR041944;
	Thu, 17 Apr 2003 00:29:12 +0200 (CEST)
	(envelope-from Danovitsch@Vitsch.net)
Message-Id: <200304170035.36043.Danovitsch@Vitsch.net>
Date: Thu, 17 Apr 2003 00:35:36 +0200
From: "Daan Vreeken [PA4DAN]" <Danovitsch@Vitsch.net>
To: FreeBSD-gnats-submit@freebsd.org
Cc: Danovitsch@Vitsch.net
Subject: pointer arithmatic error in ugen.c

>Number:         51074
>Category:       kern
>Synopsis:       [usb] [patch] pointer arithmatic error in ugen.c
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    joe
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 16 15:40:05 PDT 2003
>Closed-Date:    Wed Oct 13 23:52:30 GMT 2004
>Last-Modified:  Wed Oct 13 23:52:30 GMT 2004
>Originator:     Daan Vreeken [PA4DAN]
>Release:        FreeBSD 5.0
>Organization:
none
>Environment:
System: FreeBSD 5.0 (and all others I checked)


>Description:

I believe there is a pointer arithmatic error in line 965 of ugen.c .
The entire piece of code reads :

961:    /* throw away oldest input if the buffer is full */
962:    if(sce->fill < sce->cur && sce->cur <=3D sce->fill + count) {
963:            sce->cur +=3D count;
964:            if(sce->cur >=3D sce->limit)
965:                    sce->cur =3D sce->ibuf + (sce->limit - sce->cur);
966:            DPRINTFN(5, ("ugen_isoc_rintr: throwing away %d bytes\n",
967:                        count));
978:    }

count gets added to sce->cur .
if the pointer equals/exceeds the end of the buffer, we move it to the
beginnen of the buffer (plus the X bytes it was past the end).

If sce->cur exceeds sce->limit, (sce->cur - sce->limit) would be a negati=
ve
value. (resulting in a sce->cur pointer sitting X bytes before the beginn=
ing
of the buffer)


>How-To-Repeat:
        n/a

>Fix:

--- ugen.c.diff begins here ---
965c965
<                       sce->cur =3D sce->ibuf + (sce->limit - sce->cur);
---
>                       sce->cur =3D sce->ibuf + (sce->cur - sce->limit);
--- ugen.c.diff ends here ---

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->joe 
Responsible-Changed-By: dwmalone 
Responsible-Changed-When: Thu Apr 17 02:08:47 PDT 2003 
Responsible-Changed-Why:  
Joe - this patch to ugen looks good to me. Can you cast your eye over 
it? 


http://www.freebsd.org/cgi/query-pr.cgi?pr=51074 
State-Changed-From-To: open->closed 
State-Changed-By: le 
State-Changed-When: Wed Oct 13 23:52:09 GMT 2004 
State-Changed-Why:  
This has been fixed in rev. 1.86 of ugen.c. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=51074 
>Unformatted:
