Jump to content

Kajus

Members
  • Posts

    2
  • Joined

  • Last visited

Posts posted by Kajus

  1. Hi,

    there's a bug in console scrollBuffer function, consider following scenario:
    gcw->buffer = 0x0000
    gcw->buffer[0] = A
    gcw->buffer[1] = \n
    gcw->bufpos = 1
     

    		// Remove one line from the start
    		ep = gcw->buffer+gcw->bufpos;
    		for(p = gcw->buffer; p < ep && *p != '\n'; p++) {
    			#if GWIN_CONSOLE_ESCSEQ
    				if (*p == 27)
    					ESCtoAttr(p[1], &gcw->startattr);
    			#endif
    		}
    
    		// Was there a newline, if not delete everything.
    		if (*p != '\n') {
    			gcw->bufpos = 0;
    			return;
    		}
    
    		// Delete the data
    		dp = ++p - gcw->buffer;						// Calculate the amount to to be removed
    		gcw->bufpos -= dp;							// Calculate the new size
    		if (gcw->bufpos)
    			memcpy(gcw->buffer, p, gcw->bufpos);	// Move the rest of the dat

     

    ep becomes 0x0001, therefore for cycle exits with p = 0x0001, which is outside the used bufer area, but the if condition is found invalid as 0x0001 contains \n, dp becomes 2 and here's the bug: gcw->bufpos = bufpos - dp = 1 - 2 = overflow to very high number, memcpy overwrites huge area of memory and finally MCU crashes.

    I guess the if condition should be something like:
    if (*p == ep || *p != '\n')...

×
×
  • Create New...