[rtems commit] termios: Fix infinite loop in receive path

[Sebastian Huber]

Module:    rtems
Branch:    master
Commit:    c80f6aa9161e10259127b3b9abe7717c702daf39
Changeset: http://git.rtems.org/rtems/commit/?id=c80f6aa9161e10259127b3b9abe7717c702daf39

Author:    Sebastian Huber <sebastian.huber at embedded-brains.de>
Date:      Fri Feb 24 10:29:05 2017 +0100

termios: Fix infinite loop in receive path

In canonical mode, the raw input buffer or the canonical buffer may
overflow without an end of line.  Avoid an infinite loop in this case.

Close #2915.

---

 cpukit/libcsupport/src/termios.c     | 14 +++++++++-----
 testsuites/libtests/termios09/init.c |  3 +++
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/cpukit/libcsupport/src/termios.c b/cpukit/libcsupport/src/termios.c
index 62964e4..f5bf493 100644
--- a/cpukit/libcsupport/src/termios.c
+++ b/cpukit/libcsupport/src/termios.c
@@ -1504,13 +1504,17 @@ fillBufferQueue (struct rtems_termios_tty *tty)
     /*
      * Wait for characters
      */
-    if ( wait ) {
-      rtems_status_code sc;
+    if (wait) {
+      if (tty->ccount < CBUFSIZE - 1) {
+        rtems_status_code sc;
 
-      sc = rtems_semaphore_obtain(
-        tty->rawInBuf.Semaphore, tty->rawInBufSemaphoreOptions, timeout);
-      if (sc != RTEMS_SUCCESSFUL)
+        sc = rtems_semaphore_obtain(
+          tty->rawInBuf.Semaphore, tty->rawInBufSemaphoreOptions, timeout);
+        if (sc != RTEMS_SUCCESSFUL)
+          break;
+      } else {
         break;
+      }
     }
   }
 }
diff --git a/testsuites/libtests/termios09/init.c b/testsuites/libtests/termios09/init.c
index a32ebda..980a6ea 100644
--- a/testsuites/libtests/termios09/init.c
+++ b/testsuites/libtests/termios09/init.c
@@ -550,6 +550,9 @@ static void test_rx_callback_icanon(test_context *ctx)
   input(ctx, i, 'e');
   rtems_test_assert(dev->callback_counter == 5);
 
+  n = read(ctx->fds[i], buf, 255);
+  rtems_test_assert(n == 255);
+
   dev->tty->tty_rcv.sw_pfn = NULL;
   dev->tty->tty_rcv.sw_arg = NULL;
   set_veol_veol2(ctx, i, '\0', '\0');