From df0d169eefd17c06fb9169c2382bfecbb2852df5 Mon Sep 17 00:00:00 2001
From: andreas karlsson <andreas.karlsson@rt-labs.com>
Date: Fri, 10 Dec 2021 14:37:36 +0100
Subject: [PATCH] Fix errornous segmented download CompleteAccess

On the final segment the SDO shoud be written using the
pre-allocated buffer used to store segments during transfer.
When completed the pre-allocated buffer is written to the SDO.
This fix change to correct complete_access_subindex_loop
 - buffer, ESCvar.mbxdata
 - to use the lookup indexes for ESCVar.index -> nidx and
   ESCvar.subindex -> nsub.
---
 soes/esc_coe.c | 34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/soes/esc_coe.c b/soes/esc_coe.c
index 851f8e1..7c8082d 100644
--- a/soes/esc_coe.c
+++ b/soes/esc_coe.c
@@ -1027,32 +1027,42 @@ static void SDO_downloadsegment (void)
 
       if (coesdo->command & COE_COMMAND_LASTSEGMENTBIT)
       {
-         /* last segment */
-         ESCvar.segmented = 0;
-
          if(ESCvar.flags == COMPLETE_ACCESS_FLAG)
          {
-            int16_t nidx;
+            int16_t nidx, nsub;
+
+            if(ESCvar.frags > ESCvar.fragsleft + size)
+            {
+               set_state_idle (0, ESCvar.index, ESCvar.subindex, ABORT_TYPEMISMATCH);
+               return;
+            }
 
             nidx = SDO_findobject(ESCvar.index);
-            if (nidx < 0)
+            nsub = SDO_findsubindex (nidx, ESCvar.subindex);
+
+            if ((nidx < 0) || (nsub < 0))
             {
                set_state_idle (0, ESCvar.index, ESCvar.subindex, ABORT_NOOBJECT);
                return;
             }
+
             /* copy download data to subindexes */
             const _objd *objd = SDOobjects[nidx].objdesc;
             complete_access_subindex_loop(objd,
-                  ESCvar.index,
-                  ESCvar.subindex,
-                  (uint8_t *)ESCvar.data,
+                  nidx,
+                  nsub,
+                  (uint8_t *)ESCvar.mbxdata,
                   DOWNLOAD,
                   ESCvar.frags);
 
          }
-        /* external object write handler */
-        uint32_t abort = ESC_download_post_objecthandler
-              (ESCvar.index, ESCvar.subindex, ESCvar.flags);
+         /* last segment */
+         ESCvar.segmented = 0;
+         ESCvar.frags = 0;
+         ESCvar.fragsleft = 0;
+         /* external object write handler */
+         uint32_t abort = ESC_download_post_objecthandler
+               (ESCvar.index, ESCvar.subindex, ESCvar.flags);
          if (abort != 0)
          {
             set_state_idle (MBXout, ESCvar.index, ESCvar.subindex, abort);
@@ -1063,6 +1073,8 @@ static void SDO_downloadsegment (void)
       {
          /* more segmented transfer needed: increase offset */
          ESCvar.data += size;
+         /* number of bytes done */
+         ESCvar.fragsleft += size;
       }
 
       MBXcontrol[MBXout].state = MBXstate_outreq;