Check the image number against the DELUGE_NUM_VOLUMES. The bug was reported by David...

diff --git a/tos/lib/net/Deluge/DelugeManagerP.nc b/tos/lib/net/Deluge/DelugeManagerP.nc
index 3b97e9e595e42b21e31503ed2b3b1212892927a9..342d8ca21cfc6462209e83d9fa38aa2ec255282d 100644 (file)
--- a/tos/lib/net/Deluge/DelugeManagerP.nc
+++ b/tos/lib/net/Deluge/DelugeManagerP.nc
@@ -90,14 +90,19 @@ implementation
       break;
     case DELUGE_CMD_ONLY_DISSEMINATE:
     case DELUGE_CMD_DISSEMINATE_AND_REPROGRAM:
-      if (call Resource.isOwner() || 
-         call Resource.immediateRequest() == SUCCESS) {
+      if (request->imgNum < DELUGE_NUM_VOLUMES &&
+         (call Resource.isOwner() || 
+          call Resource.immediateRequest() == SUCCESS)) {
        call DelugeMetadata.read(imgNum2volumeId[request->imgNum]);
       } else {
        sendReply(FAIL);
       }
       break;
     case DELUGE_CMD_REPROGRAM:
+      if (!(request->imgNum < DELUGE_NUM_VOLUMES)) {
+       sendReply(FAIL);
+       break;
+      }
     case DELUGE_CMD_REBOOT:
       delugeCmd.imgNum = imgNum2volumeId[request->imgNum];
       call DelayTimer.startOneShot(1024);

diff --git a/tos/lib/net/Deluge/FlashVolumeManager/FlashVolumeManagerP.nc b/tos/lib/net/Deluge/FlashVolumeManager/FlashVolumeManagerP.nc
index 657d6795901340670d415bc907f47eeeba994a9c..56558c4214a17c8b14bf11c143a016a5e005de59 100644 (file)
--- a/tos/lib/net/Deluge/FlashVolumeManager/FlashVolumeManagerP.nc
+++ b/tos/lib/net/Deluge/FlashVolumeManager/FlashVolumeManagerP.nc
@@ -186,7 +186,7 @@ implementation
     }
 
     // Converts the image number that the user wants to the real image number
-    imgNum = imgNum2volumeId[request->imgNum];
+    imgNum = request->imgNum < DELUGE_NUM_VOLUMES ? imgNum2volumeId[request->imgNum] : 0xFF;
     
     if (imgNum != 0xFF) {
       error = SUCCESS;