* Mathieu Desnoyers ([email protected]) wrote: > fix off by one in strncpy and write asserts(). Shows only when the event > reserved fits the exact end of buffer.
Ping ? This bug deserves an immediate release, because it triggers the assert when users reach a certain amount of data. Thanks, Mathieu > > Signed-off-by: Mathieu Desnoyers <[email protected]> > --- > libust/buffers.h | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > Index: ust/libust/buffers.h > =================================================================== > --- ust.orig/libust/buffers.h 2010-08-17 18:14:30.000000000 -0400 > +++ ust/libust/buffers.h 2010-08-17 18:15:25.000000000 -0400 > @@ -522,7 +522,8 @@ static __inline__ int ust_buffers_write( > size_t buf_offset = BUFFER_OFFSET(offset, buf->chan); > > assert(buf_offset < buf->chan->subbuf_size*buf->chan->subbuf_cnt); > - assert(buf_offset + len < buf->chan->subbuf_size*buf->chan->subbuf_cnt); > + assert(buf_offset + len > + <= buf->chan->subbuf_size*buf->chan->subbuf_cnt); > > ust_buffers_do_copy(buf->buf_data + buf_offset, src, len); > > @@ -590,7 +591,8 @@ int ust_buffers_strncpy(struct ust_buffe > int terminated; > > assert(buf_offset < buf->chan->subbuf_size*buf->chan->subbuf_cnt); > - assert(buf_offset + len < buf->chan->subbuf_size*buf->chan->subbuf_cnt); > + assert(buf_offset + len > + <= buf->chan->subbuf_size*buf->chan->subbuf_cnt); > > copied = ust_buffers_do_strncpy(buf->buf_data + buf_offset, > src, len, &terminated); > > -- > Mathieu Desnoyers > Operating System Efficiency R&D Consultant > EfficiOS Inc. > http://www.efficios.com -- Mathieu Desnoyers Operating System Efficiency R&D Consultant EfficiOS Inc. http://www.efficios.com _______________________________________________ ltt-dev mailing list [email protected] http://lists.casi.polymtl.ca/cgi-bin/mailman/listinfo/ltt-dev
