frodovdr/hyperion.ng
1
0
Fork 0
mirror of https://github.com/hyperion-project/hyperion.ng.git synced 2023-10-10 13:36:59 +02:00
Code Issues Releases Wiki Activity

fixed potential buffer overflow

Browse Source 
Former-commit-id: 2c9ea902fd563b909e6d0457c4957f80be86f93f
This commit is contained in:
David Brodski 2014-09-18 20:56:32 +02:00
parent a92967fa7c
commit 5ff05d58fd
1 changed files with 14 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
libsrc/leddevice/LedDeviceWS2812b.cpp
View File

@ -269,6 +269,20 @@ int LedDeviceWS2812b::write(const std::vector<ColorRgb> &ledValues)
unsigned int colorBits = 0; // Holds the GRB color before conversion to wire bit pattern
unsigned int wireBit = 0; // Holds the current bit we will set in PWMWaveform
// Copy PWM waveform to DMA's data buffer
//printf("Copying %d words to DMA data buffer\n", NUM_DATA_WORDS);
struct control_data_s *ctl = (struct control_data_s *)virtbase;
dma_cb_t *cbp = ctl->cb;
// 72 bits per pixel / 32 bits per word = 2.25 words per pixel
// Add 1 to make sure the PWM FIFO gets the message: "we're sending zeroes"
// Times 4 because DMA works in bytes, not words
cbp->length = ((mLedCount * 2.25) + 1) * 4;
if(cbp->length > NUM_DATA_WORDS * 4) {
cbp->length = NUM_DATA_WORDS * 4;
mLedCount = (NUM_DATA_WORDS - 1) / 2.25;
}
for(size_t i=0; i<mLedCount; i++) {
// Create bits necessary to represent one color triplet (in GRB, not RGB, order)
//printf("RGB: %d, %d, %d\n", ledValues[i].red, ledValues[i].green, ledValues[i].blue);
@ -301,19 +315,6 @@ int LedDeviceWS2812b::write(const std::vector<ColorRgb> &ledValues)
}
}
// Copy PWM waveform to DMA's data buffer
//printf("Copying %d words to DMA data buffer\n", NUM_DATA_WORDS);
struct control_data_s *ctl = (struct control_data_s *)virtbase;
dma_cb_t *cbp = ctl->cb;
// 72 bits per pixel / 32 bits per word = 2.25 words per pixel
// Add 1 to make sure the PWM FIFO gets the message: "we're sending zeroes"
// Times 4 because DMA works in bytes, not words
cbp->length = ((mLedCount * 2.25) + 1) * 4;
if(cbp->length > NUM_DATA_WORDS * 4) {
cbp->length = NUM_DATA_WORDS * 4;
}
// This block is a major CPU hog when there are lots of pixels to be transmitted.
// It would go quicker with DMA.
// for(unsigned int i = 0; i < (cbp->length / 4); i++) {