From be936dd590d233bf4799e4ca7ea85252e941c8c2 Mon Sep 17 00:00:00 2001
From: Cristian Maglie <c.maglie@bug.st>
Date: Thu, 19 Sep 2013 16:22:12 +0200
Subject: [PATCH] Fixed buffer overflow in File::doBuffer() (dreggy)

Fixes #1580
---
 build/shared/revisions.txt      | 5 +++++
 libraries/Bridge/src/FileIO.cpp | 6 +++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/build/shared/revisions.txt b/build/shared/revisions.txt
index 7166b3796..a0ff85757 100644
--- a/build/shared/revisions.txt
+++ b/build/shared/revisions.txt
@@ -1,4 +1,9 @@
 
+ARDUINO 1.5.5 BETA
+
+[libraries]
+* avr: Fixed buffer overflow in File::doBuffer() (dreggy)
+
 ARDUINO 1.5.4 BETA 2013.09.10
 
 [ide]
diff --git a/libraries/Bridge/src/FileIO.cpp b/libraries/Bridge/src/FileIO.cpp
index 83c889e1a..5a3817ea0 100644
--- a/libraries/Bridge/src/FileIO.cpp
+++ b/libraries/Bridge/src/FileIO.cpp
@@ -116,10 +116,10 @@ void File::doBuffer() {
   if (buffered > 0)
     return;
 
-  // Try to buffer up to 32 characters
+  // Try to buffer up to BUFFER_SIZE characters
   readPos = 0;
-  uint8_t cmd[] = {'G', handle, sizeof(buffer)};
-  buffered = bridge.transfer(cmd, 3, buffer, sizeof(buffer)) - 1;
+  uint8_t cmd[] = {'G', handle, BUFFER_SIZE - 1};
+  buffered = bridge.transfer(cmd, 3, buffer, BUFFER_SIZE) - 1;
   //err = buff[0]; // First byte is error code
   if (buffered>0) {
     // Shift the reminder of buffer