From 6a4bf65fd8290f62b8384707c204f1ab8e192f22 Mon Sep 17 00:00:00 2001
From: Andre Puschmann <andre@softwareradiosystems.com>
Date: Fri, 5 Mar 2021 18:09:00 +0100
Subject: [PATCH] rlc_am_lte: extend check for valid status PDU

check for all NACKed SNs are smaller than ACK_SN
---
 lib/src/upper/rlc_am_lte.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/src/upper/rlc_am_lte.cc b/lib/src/upper/rlc_am_lte.cc
index ed0376241..e333b05da 100644
--- a/lib/src/upper/rlc_am_lte.cc
+++ b/lib/src/upper/rlc_am_lte.cc
@@ -1850,6 +1850,7 @@ int rlc_am_lte::rlc_am_lte_rx::get_status_pdu(rlc_status_pdu_t* status, const ui
                        rlc_am_packed_length(status),
                        max_pdu_size,
                        status->N_nack);
+        return 0;
       }
       break;
     }
@@ -2319,6 +2320,11 @@ int rlc_am_write_status_pdu(rlc_status_pdu_t* status, uint8_t* payload)
 bool rlc_am_is_valid_status_pdu(const rlc_status_pdu_t& status)
 {
   for (uint32_t i = 0; i < status.N_nack; ++i) {
+    // NACK can't be larger than ACK
+    if ((MOD + status.ack_sn - status.nacks[i].nack_sn) % MOD > RLC_AM_WINDOW_SIZE) {
+      return false;
+    }
+    // Don't NACK the ACK SN
     if (status.nacks[i].nack_sn == status.ack_sn) {
       return false;
     }