patch from Stefan Kratochwil <entwicklung@inovel.de> : canfestival-3-fm3_698.patch
Bug:
If an object dictionary entry was requested whose size exceeds
SDO_MAX_LENGTH_TRANSFERT, the memcpy() call at line 139 of objacces.c overwrites
the memory after *pDestData which causes stack corruption.
-> Bugfix:
The bug was corrected by size checking the requested data. An 'Out of
memory' error message will be generated if the requested data exceeds
SDO_MAX_LENGTH_TRANSFERT.
Additional changes:
Added dynamic buffer allocation for the SDO transfer. This feature can be used
if SDO_DYNAMIC_BUFFER_ALLOCATION is defined in config.h. The size of the
dynamically allocated buffer is controlled with
SDO_DYNAMIC_BUFFER_ALLOCATION_SIZE.
-> Note:
This change removes the detection of OD_LENGTH_DATA_INVALID errors!
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>
#include "console.h"
void showhelp(void) {
printf("\nCanFestival kernel test example console\n\n");
printf("start - start example\n");
printf("stop - stop example\n");
printf("quit - quit console\n");
printf("\n");
}
int main(int argc,char *argv[])
{
int canf_ktest_dev, cmd;
char command[10];
char device_path[20] = "/dev/";
// create absolute path name for device
strcat (device_path, DEVICE_NAME);
canf_ktest_dev = open (device_path, O_WRONLY);
if (canf_ktest_dev == -1) {
perror ("Opening device");
return 1;
}
showhelp();
while (1) {
printf("> ");
scanf ("%s", &command);
if (strcmp(command,"start") == 0)
cmd = CMD_START;
else if (strcmp(command,"stop") == 0)
cmd = CMD_STOP;
else if (strcmp(command,"quit") == 0)
break;
else {
printf("Bad command\n");
continue;
}
write(canf_ktest_dev, &cmd, sizeof(cmd));
}
close(canf_ktest_dev);
return 0;
}