phone-side
/
osmocom-bb
mirror of https://gerrit.osmocom.org/osmocom-bb
9
0
Fork 0
Code Issues Releases Wiki Activity

tpu_window: Fix int16_t overflow in tpu_window calculation 

First we add 55500 to an int16_t, then later we subtract it again.
The bug only didn't become apparent as we wrap twice, once adding
then subtracting.

Discovered by Smatch:
firmware/layer1/tpu_window.c +127 l1s_rx_win_ctrl(24) warn: value 55000 can't fit into 32767 'stop'
This commit is contained in:
Harald Welte 2011-07-16 18:01:48 +02:00
parent c9297d28e0
commit d5c9c73622
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/target/firmware/layer1/tpu_window.c
View File

@ -102,7 +102,8 @@ void l1s_win_init(void)
void l1s_rx_win_ctrl(uint16_t arfcn, enum l1_rxwin_type wtype, uint8_t tn_ofs)
{
int16_t start, stop;
int16_t start;
int32_t stop; /* prevent overflow of int16_t in L1_RXWIN_FB */
/* TN offset & TA adjust */
start = DSP_SETUP_TIME;
@ -128,7 +129,7 @@ void l1s_rx_win_ctrl(uint16_t arfcn, enum l1_rxwin_type wtype, uint8_t tn_ofs)
}
/* Window close for ABB */
twl3025_downlink(0, stop);
twl3025_downlink(0, stop & 0xffff);
/* window close for TRF6151 */
trf6151_set_mode(TRF6151_IDLE);