Out of bound memory access on dma-proxy-test if verify

[Enrico31415]

The maximum channel size is defined in:

struct channel_buffer {
    unsigned int buffer[BUFFER_SIZE / sizeof(unsigned int)];
    enum proxy_status { PROXY_NO_ERROR = 0, PROXY_BUSY = 1, PROXY_TIMEOUT = 2, PROXY_ERROR = 3 } status;

With BUFFER_SIZE = 128 * 1024 Making the maximum range of buffer[] 32768 = 128*1024/4. Assuming sizeof(unsigned int) = 4.

In the case of the user entering a test_size by argv bigger then BUFFER_SIZE, test_size became equals to BUFFER_SIZE as line 354 of dma-proxy-test. test_size is then multiplied by 1024 making the maximum value of BUFFER_SIZE1024 = 128 1024 * 1024 = 134217728.

If verify flag is provided, the cycle to verify the buffer should run:

for (i = 0; i < test_size / sizeof(unsigned int); i++)
                buffer[i] = i + ((TX_BUFFER_COUNT / BUFFER_INCREMENT) - 1) + counter;

as line 189. Since typically sizeof(unsigned int) = 4, the for loop runs from 0 to 134217728/4 = 33554432 out the maximum array value.

I think this can be fixed by moving test_size *= 1024; in an else statement of line 353.