cellular-infrastructure
/
osmo-trx
mirror of https://gerrit.osmocom.org/osmo-trx
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Transceiver.cpp: prevent out-of-range array access 

There was no a simple range check for both (NO)HANDOVER commands,
so an out-of-range access was possible. For example, a command:

  CMD HANDOVER 0 -3

might enable EDGE at run-time, because:

  a[i] == *(a + i)

Let's fix this.

Change-Id: I24a5f70e8e8097f218d7cbdef8cb10df2c35416f
This commit is contained in:
Vadim Yanitskiy 2018-03-09 05:08:23 +07:00 committed by Harald Welte
parent 8c6c5d2bcd
commit c0c6d70fe9
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
Transceiver52M/Transceiver.cpp
View File

@ -727,15 +727,23 @@ void Transceiver::driveControl(size_t chan)
}
}
} else if (match_cmd(command, "HANDOVER", &params)) {
int ts=0,ss=0;
sscanf(params, "%d %d", &ts, &ss);
mHandover[ts][ss] = true;
sprintf(response,"RSP HANDOVER 0 %d %d",ts,ss);
unsigned ts = 0, ss = 0;
sscanf(params, "%u %u", &ts, &ss);
if (ts > 7 || ss > 7) {
sprintf(response, "RSP NOHANDOVER 1 %u %u", ts, ss);
} else {
mHandover[ts][ss] = true;
sprintf(response, "RSP HANDOVER 0 %u %u", ts, ss);
}
} else if (match_cmd(command, "NOHANDOVER", &params)) {
int ts=0,ss=0;
sscanf(params, "%d %d", &ts, &ss);
mHandover[ts][ss] = false;
sprintf(response,"RSP NOHANDOVER 0 %d %d",ts,ss);
unsigned ts = 0, ss = 0;
sscanf(params, "%u %u", &ts, &ss);
if (ts > 7 || ss > 7) {
sprintf(response, "RSP NOHANDOVER 1 %u %u", ts, ss);
} else {
mHandover[ts][ss] = false;
sprintf(response, "RSP NOHANDOVER 0 %u %u", ts, ss);
}
} else if (match_cmd(command, "SETMAXDLY", &params)) {
//set expected maximum time-of-arrival
int maxDelay;