Fix file-buffer exact-fit guard (off-by-one) to prevent silent data loss - #248
Merged
PaulZC merged 1 commit intoJul 15, 2026
Merged
Conversation
storePacket() and storeFileBytes() used a strict '>' when checking whether a write fits in the file buffer's available space. This let a write of exactly fileBufferSpaceAvailable() bytes succeed, which can bring fileBufferHead back around to equal fileBufferTail. Since head == tail is used elsewhere to mean 'buffer empty', the just written bytes become invisible to fileBufferSpaceUsed() and are silently lost from extractFileBufferData(). Changing both guards to '>=' reserves fileBufferSize - 1 as the buffer's usable capacity (the standard fix for ring buffers that use head == tail to mean empty), so a write can never exactly fill the buffer and recreate the ambiguity.
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
storePacket()andstoreFileBytes()guard against overfilling the UBX file buffer with:Because the strict
>allows a write of exactlyfileBufferSpaceAvailable()bytes to proceed, such a write can bringfileBufferHeadback around to equalfileBufferTail. Elsewhere in the class,fileBufferHead == fileBufferTailis the sentinel used to mean "buffer empty" (seefileBufferSpaceUsed()). So a write that exactly fills the buffer makesfileBufferSpaceUsed()report 0 and the just-written bytes become unreachable toextractFileBufferData()-- a silent data loss with no error indication.This is reachable via the live NMEA/UBX file-buffer logging path:
storeFileBytes(&incoming, 1)is called per incoming NMEA byte, andstorePacket()is invoked from every dispatched UBX message handler. Any real logging session where the buffer is ever fully drained down tohead == tail(routine once the pointers have wrapped once) and then receives a write of exactly the remaining free space will silently lose that write's data.Fix
Change both guards from
>to>=. This reservesfileBufferSize - 1as the buffer's true usable capacity, which is the standard fix for ring buffers that usehead == tailto mean "empty" -- a write can then never exactly fill the buffer and recreate the ambiguity.Testing
Verified with a standalone extraction of the exact ring-buffer logic (compiled with
g++ -Wall -Wextra):head == tail == 7, then write exactlyfileBufferSize(10) bytes -- the old guard (10 > 10is false) wrongly accepts the write, and afterwardsfileBufferSpaceUsed()reports 0 even though 10 real bytes are sitting in the buffer;extractFileBufferData()returns 0 bytes.>=fix, that same write is correctly rejected, all partial-write/read/wrap-around behavior is unaffected, and a 256-byte/86-iteration multi-wrap sanity check through a 16-byte buffer showed zero loss or corruption.Change is 2 lines, minimal per CONTRIBUTING.md guidance, and targets
release_candidateas requested there.