Patch from John Regehr. Make queue catch it when the underlying radio

stack issues a spurious sendDone. Currently, if the queue is empty this
will cause it to access invalid memory (past the end of an array).

The real bug is the spurious sendDone, which he observed on the mica2.
However, until this bug is fixed, we need to catch it.

diff --git a/tos/system/AMQueueImplP.nc b/tos/system/AMQueueImplP.nc
index 8ea5c7aa1c5444dbfe7b142204d95bb3e7dfa8ce..51cd2aece1c3f83eee2531e2b3a4a925db67e151 100644 (file)
--- a/tos/system/AMQueueImplP.nc
+++ b/tos/system/AMQueueImplP.nc
@@ -179,13 +179,21 @@ implementation {
     }
   
     event void AMSend.sendDone[am_id_t id](message_t* msg, error_t err) {
-        if(queue[current].msg == msg) {
-            sendDone(current, msg, err);
-        }
-        else {
-            dbg("PointerBug", "%s received send done for %p, signaling for %p.\n",
-                __FUNCTION__, msg, queue[current].msg);
-        }
+      // Bug fix from John Regehr: if the underlying radio mixes things
+      // up, we don't want to read memory incorrectly. This can occur
+      // on the mica2.
+      // Note that since all AM packets go through this queue, this
+      // means that the radio has a problem. -pal
+      if (current >= numClients) {
+       return;
+      }
+      if(queue[current].msg == msg) {
+       sendDone(current, msg, err);
+      }
+      else {
+       dbg("PointerBug", "%s received send done for %p, signaling for %p.\n",
+           __FUNCTION__, msg, queue[current].msg);
+      }
     }
     
     command uint8_t Send.maxPayloadLength[uint8_t id]() {