fix crash due to length underflow

src/ChecksumConverter.cc

@@ -89,6 +89,33 @@ static uint32_t xor7(const uint8_t* data, size_t len, uint32_t sum)
     return xor8(data, len, sum) & 0x7F;
 }
 
+static uint32_t bitsum(const uint8_t* data, size_t len, uint32_t sum)
+{
+    // number of set bits in each byte
+    const uint8_t table[256] = {
+        0,1,1,2,1,2,2,3,1,2,2,3,2,3,3,4,
+        1,2,2,3,2,3,3,4,2,3,3,4,3,4,4,5,
+        1,2,2,3,2,3,3,4,2,3,3,4,3,4,4,5,
+        2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,
+        1,2,2,3,2,3,3,4,2,3,3,4,3,4,4,5,
+        2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,
+        2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,
+        3,4,4,5,4,5,5,6,4,5,5,6,5,6,6,7,
+        1,2,2,3,2,3,3,4,2,3,3,4,3,4,4,5,
+        2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,
+        2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,
+        3,4,4,5,4,5,5,6,4,5,5,6,5,6,6,7,
+        2,3,3,4,3,4,4,5,3,4,4,5,4,5,5,6,
+        3,4,4,5,4,5,5,6,4,5,5,6,5,6,6,7,
+        3,4,4,5,4,5,5,6,4,5,5,6,5,6,6,7,
+        4,5,5,6,5,6,6,7,5,6,6,7,6,7,7,8};
+    while (len--)
+    {
+        sum += table[*data++];
+    }
+    return sum;
+}
+
 static uint32_t crc_0x07(const uint8_t* data, size_t len, uint32_t crc)
 {
     // x^8 + x^2 + x^1 + x^0 (0x07)
@@ -618,7 +645,11 @@ static checksum checksumMap[] =
     {"leybold", leybold,          0x00,       0x00,       1}, // 0x22
     {"brksCryo",brksCryo,         0x00,       0x00,       1}, // 0x4A
     {"lrc",     lrc,              0x00,       0x00,       1}, // 0x23 
-    {"hexlrc",  hexlrc,           0x00,       0x00,       1}  // 0xA7
+    {"hexlrc",  hexlrc,           0x00,       0x00,       1}, // 0xA7
+    {"bitsum",  bitsum,           0x00,       0x00,       1}, // 0x21
+    {"bitsum8", bitsum,           0x00,       0x00,       1}, // 0x21
+    {"bitsum16",bitsum,           0x0000,     0x0000,     2}, // 0x0021
+    {"bitsum32",bitsum,           0x00000000, 0x00000000, 4}, // 0x00000021
 };
 
 static uint32_t mask[5] = {0, 0xFF, 0xFFFF, 0xFFFFFF, 0xFFFFFFFF};
@@ -703,8 +734,13 @@ printPseudo(const StreamFormat& format, StreamBuffer& output)
     uint_fast8_t fnum = extract<uint8_t>(info);
 
     size_t start = format.width;
-    size_t length = output.length()-format.width;
-    if (format.prec > 0) length -= format.prec;
+    size_t length = output.length();
+    if (length >= start) length -= start;
+    else length = 0;
+    if (format.prec > 0) {
+        if (length >= (size_t)format.prec) length -= format.prec;
+        else length = 0;
+    }
 
     debug("ChecksumConverter %s: output to check: \"%s\"\n",
         checksumMap[fnum].name, output.expand(start,length)());
@@ -777,9 +813,13 @@ scanPseudo(const StreamFormat& format, StreamBuffer& input, size_t& cursor)
     uint32_t xorout = extract<uint32_t>(info);
     size_t start = format.width;
     uint_fast8_t fnum = extract<uint8_t>(info);
-    size_t length = cursor-format.width;
-
-    if (format.prec > 0) length -= format.prec;
+    size_t length = cursor;
+    if (length >= start) length -= start;
+    else length = 0;
+    if (format.prec > 0) {
+        if (length >= (size_t)format.prec) length -= format.prec;
+        else length = 0;
+    }
 
     debug("ChecksumConverter %s: input to check: \"%s\n",
         checksumMap[fnum].name, input.expand(start,length)());

streamApp/tests/testChecksum

@@ -52,7 +52,11 @@ set protocol {
         out "jamcrc   %s %9.1<jamcrc>";      in "jamcrc   %=s %9.1<jamcrc>";
         out "adler32  %s %9.1<adler32>";     in "adler32  %=s %9.1<adler32>";
         out "hexsum8  %s %9.1<hexsum8>";     in "hexsum8  %=s %9.1<hexsum8>";
-        
+        out "bitsum   %s %9.1<bitsum>";      in "bitsum   %=s %9.1<bitsum>";
+        out "bitsum8  %s %9.1<bitsum8>";     in "bitsum8  %=s %9.1<bitsum8>";
+        out "bitsum16 %s %9.1<bitsum16>";    in "bitsum16 %=s %9.1<bitsum16>";
+        out "bitsum32 %s %9.1<bitsum32>";    in "bitsum32 %=s %9.1<bitsum32>";
+
         out "sum      %s %09.1<sum>";        in "sum      %=s %09.1<sum>";
         out "sum8     %s %09.1<sum8>";       in "sum8     %=s %09.1<sum8>";
         out "sum16    %s %09.1<sum16>";      in "sum16    %=s %09.1<sum16>";
@@ -88,6 +92,10 @@ set protocol {
         out "jamcrc   %s %09.1<jamcrc>";     in "jamcrc   %=s %09.1<jamcrc>";
         out "adler32  %s %09.1<adler32>";    in "adler32  %=s %09.1<adler32>";
         out "hexsum8  %s %09.1<hexsum8>";    in "hexsum8  %=s %09.1<hexsum8>";
+        out "bitsum   %s %09.1<bitsum>";     in "bitsum   %=s %09.1<bitsum>";
+        out "bitsum8  %s %09.1<bitsum8>";    in "bitsum8  %=s %09.1<bitsum8>";
+        out "bitsum16 %s %09.1<bitsum16>";   in "bitsum16 %=s %09.1<bitsum16>";
+        out "bitsum32 %s %09.1<bitsum32>";   in "bitsum32 %=s %09.1<bitsum32>";
 
         out "sum      %s %-9.1<sum>";        in "sum      %=s %-9.1<sum>";
         out "sum8     %s %-9.1<sum8>";       in "sum8     %=s %-9.1<sum8>";
@@ -124,6 +132,10 @@ set protocol {
         out "jamcrc   %s %-9.1<jamcrc>";     in "jamcrc   %=s %-9.1<jamcrc>";
         out "adler32  %s %-9.1<adler32>";    in "adler32  %=s %-9.1<adler32>";
         out "hexsum8  %s %-9.1<hexsum8>";    in "hexsum8  %=s %-9.1<hexsum8>";
+        out "bitsum   %s %-9.1<bitsum>";     in "bitsum   %=s %-9.1<bitsum>";
+        out "bitsum8  %s %-9.1<bitsum8>";    in "bitsum8  %=s %-9.1<bitsum8>";
+        out "bitsum16 %s %-9.1<bitsum16>";   in "bitsum16 %=s %-9.1<bitsum16>";
+        out "bitsum32 %s %-9.1<bitsum32>";   in "bitsum32 %=s %-9.1<bitsum32>";
 
         out "sum      %s %#9.1<sum>";        in "sum      %=s %#9.1<sum>";
         out "sum8     %s %#9.1<sum8>";       in "sum8     %=s %#9.1<sum8>";
@@ -160,7 +172,11 @@ set protocol {
         out "jamcrc   %s %#9.1<jamcrc>";     in "jamcrc   %=s %#9.1<jamcrc>";
         out "adler32  %s %#9.1<adler32>";    in "adler32  %=s %#9.1<adler32>";
         out "hexsum8  %s %#9.1<hexsum8>";    in "hexsum8  %=s %#9.1<hexsum8>";
-        
+        out "bitsum   %s %#9.1<bitsum>";     in "bitsum   %=s %#9.1<bitsum>";
+        out "bitsum8  %s %#9.1<bitsum8>";    in "bitsum8  %=s %#9.1<bitsum8>";
+        out "bitsum16 %s %#9.1<bitsum16>";   in "bitsum16 %=s %#9.1<bitsum16>";
+        out "bitsum32 %s %#9.1<bitsum32>";   in "bitsum32 %=s %#9.1<bitsum32>";
+
         out "sum      %s %#09.1<sum>";       in "sum      %=s %#09.1<sum>";
         out "sum8     %s %#09.1<sum8>";      in "sum8     %=s %#09.1<sum8>";
         out "sum16    %s %#09.1<sum16>";     in "sum16    %=s %#09.1<sum16>";
@@ -196,7 +212,11 @@ set protocol {
         out "jamcrc   %s %#09.1<jamcrc>";    in "jamcrc   %=s %#09.1<jamcrc>";
         out "adler32  %s %#09.1<adler32>";   in "adler32  %=s %#09.1<adler32>";
         out "hexsum8  %s %#09.1<hexsum8>";   in "hexsum8  %=s %#09.1<hexsum8>";
-        
+        out "bitsum   %s %#09.1<bitsum>";    in "bitsum   %=s %#09.1<bitsum>";
+        out "bitsum8  %s %#09.1<bitsum8>";   in "bitsum8  %=s %#09.1<bitsum8>";
+        out "bitsum16 %s %#09.1<bitsum16>";  in "bitsum16 %=s %#09.1<bitsum16>";
+        out "bitsum32 %s %#09.1<bitsum32>";  in "bitsum32 %=s %#09.1<bitsum32>";
+
         out "sum      %s %#-9.1<sum>";       in "sum      %=s %#-9.1<sum>";
         out "sum8     %s %#-9.1<sum8>";      in "sum8     %=s %#-9.1<sum8>";
         out "sum16    %s %#-9.1<sum16>";     in "sum16    %=s %#-9.1<sum16>";
@@ -232,6 +252,10 @@ set protocol {
         out "jamcrc   %s %#-9.1<jamcrc>";    in "jamcrc   %=s %#-9.1<jamcrc>";
         out "adler32  %s %#-9.1<adler32>";   in "adler32  %=s %#-9.1<adler32>";
         out "hexsum8  %s %#-9.1<hexsum8>";   in "hexsum8  %=s %#-9.1<hexsum8>";
+        out "bitsum   %s %#-9.1<bitsum>";    in "bitsum   %=s %#-9.1<bitsum>";
+        out "bitsum8  %s %#-9.1<bitsum8>";   in "bitsum8  %=s %#-9.1<bitsum8>";
+        out "bitsum16 %s %#-9.1<bitsum16>";  in "bitsum16 %=s %#-9.1<bitsum16>";
+        out "bitsum32 %s %#-9.1<bitsum32>";  in "bitsum32 %=s %#-9.1<bitsum32>";
         out "DONE";
     }
 }
@@ -313,7 +337,15 @@ assure "adler32  123456789 \x09\x1E\x01\xDE\n"
 send   "adler32  123456789 \x09\x1E\x01\xDE\n"
 assure "hexsum8  123456789 \x2D\n"
 send   "hexsum8  123456789 \x2D\n"
-                
+assure "bitsum   123456789 \x21\n"
+send   "bitsum   123456789 \x21\n"
+assure "bitsum8  123456789 \x21\n"
+send   "bitsum8  123456789 \x21\n"
+assure "bitsum16 123456789 \x00\x21\n"
+send   "bitsum16 123456789 \x00\x21\n"
+assure "bitsum32 123456789 \x00\x00\x00\x21\n"
+send   "bitsum32 123456789 \x00\x00\x00\x21\n"
+
 assure "sum      123456789 DD\n"
 send   "sum      123456789 DD\n"
 assure "sum8     123456789 DD\n"
@@ -384,7 +416,15 @@ assure "adler32  123456789 091E01DE\n"
 send   "adler32  123456789 091E01DE\n"
 assure "hexsum8  123456789 2D\n"
 send   "hexsum8  123456789 2D\n"
-                
+assure "bitsum   123456789 21\n"
+send   "bitsum   123456789 21\n"
+assure "bitsum8  123456789 21\n"
+send   "bitsum8  123456789 21\n"
+assure "bitsum16 123456789 0021\n"
+send   "bitsum16 123456789 0021\n"
+assure "bitsum32 123456789 00000021\n"
+send   "bitsum32 123456789 00000021\n"
+
 assure "sum      123456789 \x3D\x3D\n"
 send   "sum      123456789 \x3D\x3D\n"
 assure "sum8     123456789 \x3D\x3D\n"
@@ -455,7 +495,15 @@ assure "adler32  123456789 \x30\x39\x31\x3E\x30\x31\x3D\x3E\n"
 send   "adler32  123456789 \x30\x39\x31\x3E\x30\x31\x3D\x3E\n"
 assure "hexsum8  123456789 \x32\x3D\n"
 send   "hexsum8  123456789 \x32\x3D\n"
-                
+assure "bitsum   123456789 \x32\x31\n"
+send   "bitsum   123456789 \x32\x31\n"
+assure "bitsum8  123456789 \x32\x31\n"
+send   "bitsum8  123456789 \x32\x31\n"
+assure "bitsum16 123456789 \x30\x30\x32\x31\n"
+send   "bitsum16 123456789 \x30\x30\x32\x31\n"
+assure "bitsum32 123456789 \x30\x30\x30\x30\x30\x30\x32\x31\n"
+send   "bitsum32 123456789 \x30\x30\x30\x30\x30\x30\x32\x31\n"
+
 assure "sum      123456789 \xDD\n"
 send   "sum      123456789 \xDD\n"
 assure "sum8     123456789 \xDD\n"
@@ -526,7 +574,15 @@ assure "adler32  123456789 \xDE\x01\x1E\x09\n"
 send   "adler32  123456789 \xDE\x01\x1E\x09\n"
 assure "hexsum8  123456789 \x2D\n"
 send   "hexsum8  123456789 \x2D\n"
-                
+assure "bitsum   123456789 \x21\n"
+send   "bitsum   123456789 \x21\n"
+assure "bitsum8  123456789 \x21\n"
+send   "bitsum8  123456789 \x21\n"
+assure "bitsum16 123456789 \x21\x00\n"
+send   "bitsum16 123456789 \x21\x00\n"
+assure "bitsum32 123456789 \x21\x00\x00\x00\n"
+send   "bitsum32 123456789 \x21\x00\x00\x00\n"
+
 assure "sum      123456789 DD\n"
 send   "sum      123456789 DD\n"
 assure "sum8     123456789 DD\n"
@@ -597,7 +653,15 @@ assure "adler32  123456789 DE011E09\n"
 send   "adler32  123456789 DE011E09\n"
 assure "hexsum8  123456789 2D\n"
 send   "hexsum8  123456789 2D\n"
-                
+assure "bitsum   123456789 21\n"
+send   "bitsum   123456789 21\n"
+assure "bitsum8  123456789 21\n"
+send   "bitsum8  123456789 21\n"
+assure "bitsum16 123456789 2100\n"
+send   "bitsum16 123456789 2100\n"
+assure "bitsum32 123456789 21000000\n"
+send   "bitsum32 123456789 21000000\n"
+
 assure "sum      123456789 \x3D\x3D\n"
 send   "sum      123456789 \x3D\x3D\n"
 assure "sum8     123456789 \x3D\x3D\n"
@@ -668,6 +732,14 @@ assure "adler32  123456789 \x3D\x3E\x30\x31\x31\x3E\x30\x39\n"
 send   "adler32  123456789 \x3D\x3E\x30\x31\x31\x3E\x30\x39\n"
 assure "hexsum8  123456789 \x32\x3D\n"
 send   "hexsum8  123456789 \x32\x3D\n"
+assure "bitsum   123456789 \x32\x31\n"
+send   "bitsum   123456789 \x32\x31\n"
+assure "bitsum8  123456789 \x32\x31\n"
+send   "bitsum8  123456789 \x32\x31\n"
+assure "bitsum16 123456789 \x32\x31\x30\x30\n"
+send   "bitsum16 123456789 \x32\x31\x30\x30\n"
+assure "bitsum32 123456789 \x32\x31\x30\x30\x30\x30\x30\x30\n"
+send   "bitsum32 123456789 \x32\x31\x30\x30\x30\x30\x30\x30\n"
 assure "DONE\n"
                 
 finish