cellular-infrastructure
/
osmo-bts
mirror of https://gerrit.osmocom.org/osmo-bts
9
0
Fork 0
Code Issues Releases Wiki Activity

bts-trx: amr: Fix return code of osmo_amr_rtp_dec() checked too late 

If len is < 0, it means osmo_amr_rtp_dec() failed and some of the out
variables there are not set. We should check the return code before
continuing and using potentially uninitialized values.

Change-Id: I76020c6b5dc8d3e52e8c5be8cdecdf8a0bb52ed9
This commit is contained in:
Pau Espin 2022-03-02 13:54:46 +01:00
parent df505a503f
commit bd02811e7e
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/osmo-bts-trx/sched_lchan_tchf.c
View File

@ -441,6 +441,10 @@ inval_mode1:
len = osmo_amr_rtp_dec(msg_tch->l2h, msgb_l2len(msg_tch),
&cmr_codec, &cmi, &ft_codec,
&bfi, &sti);
if (len < 0) {
LOGL1SB(DL1P, LOGL_ERROR, l1ts, br, "Cannot send invalid AMR payload\n");
goto free_bad_msg;
}
cmr = -1;
ft = -1;
for (i = 0; i < chan_state->codecs; i++) {
@ -478,10 +482,6 @@ inval_mode2:
LOGL1SB(DL1P, LOGL_ERROR, l1ts, br, "TCH mode invalid, please fix!\n");
goto free_bad_msg;
}
if (len < 0) {
LOGL1SB(DL1P, LOGL_ERROR, l1ts, br, "Cannot send invalid AMR payload\n");
goto free_bad_msg;
}
if (msgb_l2len(msg_tch) != len) {
LOGL1SB(DL1P, LOGL_ERROR, l1ts, br, "Cannot send payload with "
"invalid length! (expecting %d, received %d)\n",