From a71da8de12fd7e8f68cbaca3cd2d929107b7192a Mon Sep 17 00:00:00 2001
From: Giovanni Di Sirio <gdisirio@gmail.com>
Date: Wed, 23 Dec 2015 12:47:54 +0000
Subject: git-svn-id: svn://svn.code.sf.net/p/chibios/svn/trunk@8635
 35acf78f-673a-0410-8e92-d51de3d6d3f4

---
 os/hal/src/hal_buffers.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'os')

diff --git a/os/hal/src/hal_buffers.c b/os/hal/src/hal_buffers.c
index 2f47cd649..7c309305f 100644
--- a/os/hal/src/hal_buffers.c
+++ b/os/hal/src/hal_buffers.c
@@ -135,7 +135,7 @@ void ibqPostFullBufferI(input_buffers_queue_t *ibqp, size_t size) {
 
   osalDbgCheckClassI();
 
-  osalDbgCheck(size > 0);
+  osalDbgCheck((size > 0) && (size <= ibqp->bsize - sizeof (size_t)));
   osalDbgAssert(!ibqIsFullI(ibqp), "buffers queue full");
 
   /* Writing size field in the buffer.*/
@@ -510,12 +510,14 @@ msg_t obqGetEmptyBufferTimeout(output_buffers_queue_t *obqp,
  * @note    The object callback is called after releasing the buffer.
  *
  * @param[in] obqp      pointer to the @p output_buffers_queue_t object
- * @param[in] size      used size of the buffer
+ * @param[in] size      used size of the buffer, cannot be zero
  *
  * @api
  */
 void obqPostFullBuffer(output_buffers_queue_t *obqp, size_t size) {
 
+  osalDbgCheck((size > 0) && (size <= obqp->bsize - sizeof (size_t)));
+
   osalSysLock();
 
   osalDbgAssert(!obqIsFullI(obqp), "buffers queue full");
-- 
cgit v1.2.3