cellular-infrastructure
/
osmo-bts
mirror of https://gerrit.osmocom.org/osmo-bts
9
0
Fork 0
Code Issues Releases Wiki Activity

measurement: do not call msgb_l3len without checking 

The function lchan_meas_handle_sacch() calls msgb_l3len without checking
if l3h is even populated. Lets add a check to be sure.

Change-Id: Ie5a9fe1ba880e68edb74f5f4ca559ac191330d4f
This commit is contained in:
Philipp Maier 2022-10-06 18:21:11 +02:00
parent 2950c0363d
commit 0087a1137e
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/common/measurement.c
View File

@ -916,6 +916,8 @@ void lchan_meas_handle_sacch(struct gsm_lchan *lchan, struct msgb *msg)
uint8_t ms_ta;
int8_t ul_rssi;
int16_t ul_ci_cb;
uint8_t *l3;
unsigned int l3_len;
if (msgb_l2len(msg) == GSM_MACBLOCK_LEN) {
/* Some brilliant engineer decided that the ordering of
@ -945,7 +947,9 @@ void lchan_meas_handle_sacch(struct gsm_lchan *lchan, struct msgb *msg)
}
timing_offset = ms_to_valid(lchan) ? ms_to2rsl(lchan, ms_ta) : -1;
rc = rsl_tx_meas_res(lchan, msgb_l3(msg), msgb_l3len(msg), timing_offset);
l3 = msgb_l3(msg);
l3_len = l3 ? msgb_l3len(msg) : 0;
rc = rsl_tx_meas_res(lchan, l3, l3_len, timing_offset);
if (rc == 0) /* Count successful transmissions */
lchan->meas.res_nr++;