diff options
author | Michael Sevakis <jethead71@rockbox.org> | 2011-02-09 08:44:37 +0000 |
---|---|---|
committer | Michael Sevakis <jethead71@rockbox.org> | 2011-02-09 08:44:37 +0000 |
commit | 19ea72ff63744c51292cd1d2d1c2792b009892aa (patch) | |
tree | 5b76b74b1402050dc6569d5763f5500270067e5e | |
parent | 06023f311003ba5b357c1132895afc829dff43d4 (diff) | |
download | rockbox-19ea72ff63744c51292cd1d2d1c2792b009892aa.tar.gz rockbox-19ea72ff63744c51292cd1d2d1c2792b009892aa.zip |
buffering: Fix a case that could allow widx to fully wrap to ridx and overflow the ringbuffer.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@29257 a1c6a512-1295-4272-9138-f99709370657
-rw-r--r-- | apps/buffering.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/apps/buffering.c b/apps/buffering.c index 8d41324190..e37b053881 100644 --- a/apps/buffering.c +++ b/apps/buffering.c | |||
@@ -254,7 +254,7 @@ static struct memory_handle *add_handle(size_t data_size, bool can_wrap, | |||
254 | size_t shift; | 254 | size_t shift; |
255 | size_t new_widx; | 255 | size_t new_widx; |
256 | size_t len; | 256 | size_t len; |
257 | int overlap; | 257 | ssize_t overlap; |
258 | 258 | ||
259 | if (num_handles >= BUF_MAX_HANDLES) | 259 | if (num_handles >= BUF_MAX_HANDLES) |
260 | return NULL; | 260 | return NULL; |
@@ -296,7 +296,7 @@ static struct memory_handle *add_handle(size_t data_size, bool can_wrap, | |||
296 | 296 | ||
297 | /* How much space are we short in the actual ring buffer? */ | 297 | /* How much space are we short in the actual ring buffer? */ |
298 | overlap = ringbuf_add_cross(buf_widx, shift + len, buf_ridx); | 298 | overlap = ringbuf_add_cross(buf_widx, shift + len, buf_ridx); |
299 | if (overlap >= 0 && (alloc_all || (unsigned)overlap > data_size)) { | 299 | if (overlap >= 0 && (alloc_all || (size_t)overlap >= data_size)) { |
300 | /* Not enough space for required allocations */ | 300 | /* Not enough space for required allocations */ |
301 | mutex_unlock(&llist_mod_mutex); | 301 | mutex_unlock(&llist_mod_mutex); |
302 | mutex_unlock(&llist_mutex); | 302 | mutex_unlock(&llist_mutex); |