PentHertz
/
srsLTE
mirror of https://github.com/PentHertz/srsLTE.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add extra length check for RLC UM

This commit is contained in:
Andre Puschmann 2018-10-05 12:17:44 +02:00
parent d234f4a614
commit 580ce3e298
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/src/upper/rlc_tm.cc
View File

@ -153,7 +153,7 @@ int rlc_tm::read_pdu(uint8_t *payload, uint32_t nof_bytes)
{
uint32_t pdu_size = ul_queue.size_tail_bytes();
if (pdu_size > nof_bytes) {
log->error("TX %s PDU size larger than MAC opportunity\n", rrc->get_rb_name(lcid).c_str());
log->error("TX %s PDU size larger than MAC opportunity (%d > %d)\n", rrc->get_rb_name(lcid).c_str(), pdu_size, nof_bytes);
return -1;
}
byte_buffer_t *buf;

5
lib/src/upper/rlc_um.cc
View File

@ -774,6 +774,11 @@ void rlc_um::rlc_um_rx::reassemble_rx_sdus()
if (rx_sdu->N_bytes == 0 && i == 0 && !rlc_um_start_aligned(rx_window[vr_ur].header.fi)) {
log->warning_hex(rx_window[vr_ur].buf->msg, len, "Dropping first %d B of SN %d due to lost start segment\n", len, vr_ur);
if (rx_window[vr_ur].buf->N_bytes < len) {
log->error("Dropping remaining remainder of SN %d too (N_bytes=%u < len=%d)\n", vr_ur, rx_window[vr_ur].buf->N_bytes, len);
goto clean_up_rx_window;
}
// Advance data pointers and continue with next segment
rx_window[vr_ur].buf->msg += len;
rx_window[vr_ur].buf->N_bytes -= len;