summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorMathias K <kesmtp@freenet.de>2011-02-24 13:00:59 +0100
committerØyvind Harboe <oyvind.harboe@zylin.com>2011-02-24 23:20:03 +0100
commit6ddcee7d20ee873f1c214736c22f29d9781dded4 (patch)
treed74bc998c444b9f17775f5eadc3dd6da27c83c36 /src
parent47b5829db40459650866488ab46008fd8b7e191c (diff)
downloadopenocd_libswd-6ddcee7d20ee873f1c214736c22f29d9781dded4.tar.gz
openocd_libswd-6ddcee7d20ee873f1c214736c22f29d9781dded4.tar.bz2
openocd_libswd-6ddcee7d20ee873f1c214736c22f29d9781dded4.tar.xz
openocd_libswd-6ddcee7d20ee873f1c214736c22f29d9781dded4.zip
ft2232: fix possible read buffer overflow
This patch fix a possible read buffer overflow in ft2232_execute_queue. Also the correct read queue size for libftdi and libftd2xx was added and and tested. In function ft2232_write a uninitialized value was initialized because we don't know if this value was set in the ftdi api call.
Diffstat (limited to 'src')
-rw-r--r--src/jtag/drivers/ft2232.c20
1 files changed, 17 insertions, 3 deletions
diff --git a/src/jtag/drivers/ft2232.c b/src/jtag/drivers/ft2232.c
index 9024f8e0..a84d069c 100644
--- a/src/jtag/drivers/ft2232.c
+++ b/src/jtag/drivers/ft2232.c
@@ -373,6 +373,12 @@ static int require_send;
a comment would have been nice.
*/
+#if BUILD_FT2232_FTD2XX == 1
+#define FT2232_BUFFER_READ_QUEUE_SIZE (64*64)
+#else
+#define FT2232_BUFFER_READ_QUEUE_SIZE (64*4)
+#endif
+
#define FT2232_BUFFER_SIZE 131072
static uint8_t* ft2232_buffer = NULL;
@@ -499,7 +505,7 @@ static int ft2232_write(uint8_t* buf, int size, uint32_t* bytes_written)
{
#if BUILD_FT2232_FTD2XX == 1
FT_STATUS status;
- DWORD dw_bytes_written;
+ DWORD dw_bytes_written = 0;
if ((status = FT_Write(ftdih, buf, size, &dw_bytes_written)) != FT_OK)
{
*bytes_written = dw_bytes_written;
@@ -2081,12 +2087,20 @@ static int ft2232_execute_queue(void)
while (cmd)
{
+ /* fill the write buffer with the desired command */
if (ft2232_execute_command(cmd) != ERROR_OK)
retval = ERROR_JTAG_QUEUE_FAILED;
- /* Start reading input before FT2232 TX buffer fills up */
+ /* Start reading input before FT2232 TX buffer fills up.
+ * Sometimes this happens because we don't know the
+ * length of the last command before we execute it. So
+ * we simple inform the user.
+ */
cmd = cmd->next;
- if (ft2232_expect_read > 256)
+
+ if (ft2232_expect_read >= FT2232_BUFFER_READ_QUEUE_SIZE )
{
+ if (ft2232_expect_read > (FT2232_BUFFER_READ_QUEUE_SIZE+1) )
+ LOG_WARNING("read buffer size looks to high");
if (ft2232_send_and_recv(first_unsent, cmd) != ERROR_OK)
retval = ERROR_JTAG_QUEUE_FAILED;
first_unsent = cmd;