From: Lars Op den Kamp <lars@opdenkamp.eu>
Date: Mon, 26 Mar 2012 14:18:43 +0000 (+0200)
Subject: cec: check whether the destination is valid before setting anything in m_bWaitingForA... 
X-Git-Tag: upstream/2.2.0~1^2~31^2~47^2~1
X-Git-Url: https://git.piment-noir.org/?a=commitdiff_plain;h=aa4cfa6482c4408f80b5393baf2dcefceb8ddc9b;p=deb_libcec.git

cec: check whether the destination is valid before setting anything in m_bWaitingForAck. fixes heap corruption and crash on exit. bugzid: 479
---

diff --git a/src/lib/adapter/USBCECAdapterCommunication.cpp b/src/lib/adapter/USBCECAdapterCommunication.cpp
index 18e12bc..ac66d04 100644
--- a/src/lib/adapter/USBCECAdapterCommunication.cpp
+++ b/src/lib/adapter/USBCECAdapterCommunication.cpp
@@ -289,6 +289,7 @@ void *CUSBCECAdapterCommunication::Process(void)
     m_port = NULL;
   }
 
+  m_rcvCondition.Broadcast();
   return NULL;
 }
 
@@ -310,6 +311,7 @@ cec_adapter_message_state CUSBCECAdapterCommunication::Write(const cec_command &
   output->retryTimeout = iRetryLineTimeout;
   output->tries = 0;
 
+  if (data.destination < 15)
   {
     CLockObject lock(m_mutex);
     m_bWaitingForAck[data.destination] = true;
@@ -439,10 +441,13 @@ bool CUSBCECAdapterCommunication::ParseMessage(const CCECAdapterMessage &msg)
       if (m_currentframe.ack == 0x1)
       {
         m_lastDestination    = m_currentframe.destination;
-        if (!m_bWaitingForAck[m_currentframe.destination])
-          m_processor->HandlePoll(m_currentframe.initiator, m_currentframe.destination);
-        else
-          m_bWaitingForAck[m_currentframe.destination] = false;
+        if (m_currentframe.destination < 15)
+        {
+          if (!m_bWaitingForAck[m_currentframe.destination])
+            m_processor->HandlePoll(m_currentframe.initiator, m_currentframe.destination);
+          else
+            m_bWaitingForAck[m_currentframe.destination] = false;
+        }
       }
     }
     break;
@@ -822,9 +827,9 @@ bool CUSBCECAdapterCommunication::WaitForAck(CCECAdapterMessage &message)
 
     if (msg.Message() == MSGCODE_FRAME_START && msg.IsACK())
     {
-      if (m_bWaitingForAck[msg.Initiator()])
+      if (msg.Initiator() < 15 && m_bWaitingForAck[msg.Initiator()])
         m_bWaitingForAck[msg.Initiator()] = false;
-      else
+      else if (msg.Initiator() < 15)
       {
         m_processor->HandlePoll(msg.Initiator(), msg.Destination());
         m_lastDestination = msg.Initiator();