Problems with AxisCamera.cpp

[JohnGaby]

We are having two crashing problems which occur in AxisCamera.cpp. The first happens if there is no camera connected and happens at this point in the code (Lines 621-629):

if (getaddrinfo(m_cameraHost.c_str(), "80", 0, &address) == -1)
{
if (setError) wpi_setErrnoErrorWithContext("Failed to create the camera socket");
return -1;
}

/* connect to server */
if (connect(camSocket, address->ai_addr, address->ai_addrlen) == -1)
{

It crashes on the 'connect' line due to the fact that 'address' is null. This is because the check for the return value of getaddrinfo is incorrect. The documentation for that function states that the return is zero for success and a number of non-zero values for failure. Hence this function is failing and not being detected, which leads to the null pointer when 'connect' is called.

This is easy enough to fix, and I have done so. However, I am wondering if there is an update for the WPILib library where this is fixed?

My second problem is more serious and happens at this point in the code (Lines 461-479):

char initialReadBuffer[kMaxPacketSize] = "";
char intermediateBuffer[1];
char *trailingPtr = initialReadBuffer;
int trailingCounter = 0;
while (counter)
{
// TODO: fix me... this cannot be the most efficient way to approach this, reading one byte at a time.
if (recv(m_cameraSocket, intermediateBuffer, 1, 0) == -1)
{
wpi_setErrnoErrorWithContext("Failed to read image header");
close(m_cameraSocket);
return;
}
strncat(initialReadBuffer, intermediateBuffer, 1);
// trailingCounter ensures that we start looking for the 4 byte string after
// there is at least 4 bytes total. Kind of obscure.
// look for 2 blank lines (\r\n)
if (NULL != strstr(trailingPtr, "\r\n\r\n"))
{

The crash occurs on the 'strstr' line, and the cause appears to be that 'trailingPtr' has been incremented to beyond the size of the buffer. This error happens quite infrequently, and randomly but is very serious since if it occurs, our robot is disabled. I suspect the problem lies in the data stream being corrupt, but the code should certainly handle this without crashing.

The second problem is more serious because I don't have a work around. Does anyone know of a fix or workaround for this issue?

Thanks.