Error in length provided to memset, resulting in a buffer overflow. Error now fixed.

[tinyos-2.x.git] / tos / lib / printf / PrintfP.nc

diff --git a/tos/lib/printf/PrintfP.nc b/tos/lib/printf/PrintfP.nc
index 0382f9b84f5b7bc580a6f11ba233c70c61bc6d32..c0b522a9ebff35c94d064158055299dbda1354ba 100644 (file)
--- a/tos/lib/printf/PrintfP.nc
+++ b/tos/lib/printf/PrintfP.nc
@@ -79,16 +79,16 @@ implementation {
   uint8_t length_to_send;
   
   task void retrySend() {
-    if(call AMSend.send(AM_BROADCAST_ADDR, &printfMsg, sizeof(printf_msg)) != SUCCESS)
+    if(call AMSend.send(AM_BROADCAST_ADDR, &printfMsg, sizeof(printf_msg_t)) != SUCCESS)
       post retrySend();
   }
   
   void sendNext() {
-       printf_msg* m = (printf_msg*)call Packet.getPayload(&printfMsg, NULL);
-       length_to_send = (bytes_left_to_flush < sizeof(printf_msg)) ? bytes_left_to_flush : sizeof(printf_msg);
-       memset(m->buffer, 0, sizeof(printfMsg));
-       memcpy(m->buffer, (uint8_t*)next_byte, length_to_send);
-    if(call AMSend.send(AM_BROADCAST_ADDR, &printfMsg, sizeof(printf_msg)) != SUCCESS)
+    printf_msg_t* m = (printf_msg_t*)call Packet.getPayload(&printfMsg, NULL);
+    length_to_send = (bytes_left_to_flush < sizeof(printf_msg_t)) ? bytes_left_to_flush : sizeof(printf_msg_t);
+    memset(m->buffer, 0, sizeof(m->buffer));
+    memcpy(m->buffer, (uint8_t*)next_byte, length_to_send);
+    if(call AMSend.send(AM_BROADCAST_ADDR, &printfMsg, sizeof(printf_msg_t)) != SUCCESS)
       post retrySend();  
     else {
       bytes_left_to_flush -= length_to_send;
@@ -139,7 +139,7 @@ implementation {
        atomic {
          if(state == S_STARTED && (next_byte > buffer)) {
            state = S_FLUSHING;
-        bytes_left_to_flush = next_byte - buffer;
+            bytes_left_to_flush = next_byte - buffer;
            next_byte = buffer;
          }
          else return FAIL;