From owner-freebsd-bugs  Sat Mar 29 01:50:05 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id BAA17999
          for bugs-outgoing; Sat, 29 Mar 1997 01:50:05 -0800 (PST)
Received: (from gnats@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id BAA17986;
          Sat, 29 Mar 1997 01:50:03 -0800 (PST)
Resent-Date: Sat, 29 Mar 1997 01:50:03 -0800 (PST)
Resent-Message-Id: <199703290950.BAA17986@freefall.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@freefall.FreeBSD.org,
        tenser@spitfire.ecsel.psu.edu
Received: from odin.ecsel.psu.edu (qmailr@odin.ecsel.psu.edu [146.186.218.62])
          by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id BAA17804
          for <FreeBSD-gnats-submit@freebsd.org>; Sat, 29 Mar 1997 01:43:12 -0800 (PST)
Received: (qmail 549 invoked by uid 1000); 29 Mar 1997 09:43:09 -0000
Message-Id: <19970329094309.548.qmail@odin.ecsel.psu.edu>
Date: 29 Mar 1997 09:43:09 -0000
From: Dan Cross <tenser@spitfire.ecsel.psu.edu>
Reply-To: tenser@spitfire.ecsel.psu.edu
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: bin/3139: bug in qcamcontrol...
Sender: owner-bugs@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         3139
>Category:       bin
>Synopsis:       qcamcontrol has a bug where I/O errors are not reported.
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Mar 29 01:50:01 PST 1997
>Last-Modified:
>Originator:     Dan Cross
>Organization:
PSU Mathematics
>Release:        FreeBSD 2.2-RELEASE i386
>Environment:

	Pentium, 16 MB RAM, 1.2GB disk, Connectix QuickCam.

>Description:

	The read loop in qcamcontrol.c keeps a count of the current
	number of bytes read in the variable ``bytes'' defined as
	type size_t.  In the loop, is tested for values less than
	zero to detect errors.  However, size_t is defined by our
	buddies over at ANSI as being an unsigned integral value,
	thus the negative is never detected.  Further, bytes should
	really be ssize_t, as that is what read(2) is defined to
	return, and that is a signed value.

>How-To-Repeat:

	Try reading from a broken QuickCam.  Notice the infinte loop.  :-)

>Fix:
	
	A patch is included below; it merely changes the type of
	``bytes'' to be ssize_t, as specified by the read(2) man
	page.

*** qcamcontrol.c	1997/03/29 09:32:14	1.1
--- qcamcontrol.c	1997/03/29 09:41:08
***************
*** 69,75 ****
  {
  	struct qcam info;
  	int fd, len;
! 	size_t bytes;
  	char opt;
  
  	static char buffer[QC_MAX_XSIZE*QC_MAX_YSIZE];
--- 69,75 ----
  {
  	struct qcam info;
  	int fd, len;
! 	ssize_t bytes;
  	char opt;
  
  	static char buffer[QC_MAX_XSIZE*QC_MAX_YSIZE];
>Audit-Trail:
>Unformatted: