Attachment 406409 Details for Bug 336658

Why I think that hplip-0.9.7 in SLE10 is not affected

bar (text/plain), 3.14 KB, created by Johannes Meixner on 2010-12-28 15:11:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Johannes Meixner

Created: 2010-12-28 15:11:17 UTC

Size: 3.14 KB

patch

obsolete

>
>io/hpiod/hpiod.h:
>----------------------------------------------------------------------------------------------------------
>#define BUFFER_SIZE 8192  /* General Read/Write buffer. */
>...
>#define HEADER_SIZE 4096   /* Rough estimate of hpiod message header */
>----------------------------------------------------------------------------------------------------------
>
>
>io/hpiod/system.cpp:
>----------------------------------------------------------------------------------------------------------
>#include "hpiod.h"
>----------------------------------------------------------------------------------------------------------
>int System::GetSnmp(char *ip, int port, char *szoid, unsigned char *buffer, unsigned int size, int *type, int *pml_result, int *result)
>{
>...
>            len = (sizeof(uint32_t) < size) ? sizeof(uint32_t) : size;
>...
>            memcpy(buffer, tmp+i, len);
>...
>            len = (vars->val_len < size) ? vars->val_len : size;
>            memcpy(buffer, vars->val.string, len);
>...
>   return len;
>}
>----------------------------------------------------------------------------------------------------------
>int System::GetPml(int device, int channel, char *snmp_oid, char *sendBuf)
>{
>...
>   char message[BUFFER_SIZE];
>...
>      dLen = GetSnmp(((JetDirectDevice *)pD)->GetIP(), ((JetDirectDevice *)pD)->GetPort(), snmp_oid, (unsigned char *)message, sizeof(message), &dt, &status, &result);
>...
>      p = (unsigned char *)message;
>...
>   len = sprintf(sendBuf, "msg=GetPMLResult\nresult-code=%d\npml-result-code=%d\ntype=%d\nlength=%d\ndata:\n", R_AOK, status, dt, dLen);
>   memcpy(&sendBuf[len], p, dLen);
>   len += dLen;
>...
>   return len;
>}
>----------------------------------------------------------------------------------------------------------
>int System::ExecuteMsg(SessionAttributes *psa, char *recvBuf, int rlen, char *sendBuf, int slen)
>{
>...
>      len = GetPml(ma.descriptor, ma.channel, ma.oid, sendBuf);
>...
>----------------------------------------------------------------------------------------------------------
>
>
>io/hpiod/hpiod.cpp:
>----------------------------------------------------------------------------------------------------------
>#include "hpiod.h"
>----------------------------------------------------------------------------------------------------------
>void session(SessionAttributes *psa)
>{
>   char recvBuf[BUFFER_SIZE+HEADER_SIZE];
>   char sendBuf[BUFFER_SIZE+HEADER_SIZE];
>...
>      slen = pS->ExecuteMsg(psa, recvBuf, len, sendBuf, sizeof(sendBuf));
>----------------------------------------------------------------------------------------------------------
>
>
>Summary:
>
>In io/hpiod/hpiod.cpp
>session calls ExecuteMsg with a sendBuf of BUFFER_SIZE + HEADER_SIZE = 8192 + 4096 = 12288
>
>In io/hpiod/system.cpp
>ExecuteMsg calls GetPml with this sendBuf of 12288 
>where
>GetPml calls GetSnmp with a message of BUFFER_SIZE = 8192
>       and finally it copies the message to sendBuf
>       with a prefix which contains 4 integers and a fixed text of 99 characters
>       i.e. it copies 99 bytes text
>                      + 4 times up to 21 bytes text in case of 64-bit integers
>                      + up to 8192 bytes message
>                      <= 8375 < 12288
>

Actions: View

Attachments on bug 336658: 196351 | 403535 | 406409