From 5ccca2f8fb12e028b579d65fd3af9de93870a7ba Mon Sep 17 00:00:00 2001 From: Marcus Meissner Date: Mon, 9 Aug 2004 15:58:16 +0000 Subject: [PATCH] fixed bufferhandling, we were overwriting unallocated memory in some cases. git-svn-id: https://svn.code.sf.net/p/gphoto/code/trunk/libgphoto2@7273 67ed7778-7388-44ab-90cf-0a291f65f57c --- camlibs/ricoh/ChangeLog | 5 +++++ camlibs/ricoh/g3.c | 8 ++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/camlibs/ricoh/ChangeLog b/camlibs/ricoh/ChangeLog index 3293afa54..dbd8d51e6 100644 --- a/camlibs/ricoh/ChangeLog +++ b/camlibs/ricoh/ChangeLog @@ -1,3 +1,8 @@ +2004-08-09 Marcus Meissner + + * g3.c: fixed buffer handling, we were overwriting + unallocated memory with newer libusb. + 2004-05-19 Hubert Figuiere * g3.c (camera_abilities): Camera is Medion MD 6126 diff --git a/camlibs/ricoh/g3.c b/camlibs/ricoh/g3.c index 817cc32d1..06bc92fcd 100644 --- a/camlibs/ricoh/g3.c +++ b/camlibs/ricoh/g3.c @@ -69,10 +69,14 @@ g3_channel_read(GPPort *port, int *channel, char **buffer, int *len) *channel = xbuf[1]; *len = xbuf[4] + (xbuf[5]<<8) + (xbuf[6]<<16) + (xbuf[7]<<24); + /* Safety buffer of 0x800 ... we can only read in 0x800 chunks, + * otherwise the communication gets hickups. However *len might be + * less. + */ if (!*buffer) - *buffer = malloc(*len + 1); + *buffer = malloc(*len + 1 + 0x800); else - *buffer = realloc(*buffer, *len + 1); + *buffer = realloc(*buffer, *len + 1 + 0x800); tocopy = *len; if (tocopy > 0x800-8) tocopy = 0x800-8; memcpy(*buffer, xbuf+8, tocopy);