PentHertz
/
srsLTE
mirror of https://github.com/PentHertz/srsLTE.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add check for rx_window tailroom

This commit is contained in:
Ismael Gomez 2018-07-04 13:26:57 +02:00
parent 9d6c323001
commit 2a4a84a578
1 changed files with 23 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
lib/src/upper/rlc_am.cc
View File

@ -1166,6 +1166,7 @@ void rlc_am::handle_control_pdu(uint8_t *payload, uint32_t nof_bytes)
void rlc_am::reassemble_rx_sdus() void rlc_am::reassemble_rx_sdus()
{ {
uint32_t len = 0;
if(!rx_sdu) { if(!rx_sdu) {
rx_sdu = pool_allocate; rx_sdu = pool_allocate;
if (!rx_sdu) { if (!rx_sdu) {
@ -1185,41 +1186,46 @@ void rlc_am::reassemble_rx_sdus()
// Handle any SDU segments // Handle any SDU segments
for(uint32_t i=0; i<rx_window[vr_r].header.N_li; i++) for(uint32_t i=0; i<rx_window[vr_r].header.N_li; i++)
{ {
uint32_t len = rx_window[vr_r].header.li[i]; len = rx_window[vr_r].header.li[i];
// sanity check to avoid zero-size SDUs // sanity check to avoid zero-size SDUs
if (len == 0) { if (len == 0) {
break; break;
} }
if (rx_sdu->get_tailroom() >= len) { if (rx_sdu->get_tailroom() >= len) {
memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len); if (rx_window[vr_r].buf->get_tailroom() >= len) {
rx_sdu->N_bytes += len; memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len);
rx_window[vr_r].buf->msg += len; rx_sdu->N_bytes += len;
rx_window[vr_r].buf->N_bytes -= len; rx_window[vr_r].buf->msg += len;
log->info_hex(rx_sdu->msg, rx_sdu->N_bytes, "%s Rx SDU (%d B)", rrc->get_rb_name(lcid).c_str(), rx_sdu->N_bytes); rx_window[vr_r].buf->N_bytes -= len;
rx_sdu->set_timestamp(); log->info_hex(rx_sdu->msg, rx_sdu->N_bytes, "%s Rx SDU (%d B)", rrc->get_rb_name(lcid).c_str(), rx_sdu->N_bytes);
pdcp->write_pdu(lcid, rx_sdu); rx_sdu->set_timestamp();
pdcp->write_pdu(lcid, rx_sdu);
rx_sdu = pool_allocate; rx_sdu = pool_allocate;
if (!rx_sdu) { if (!rx_sdu) {
#ifdef RLC_AM_BUFFER_DEBUG #ifdef RLC_AM_BUFFER_DEBUG
log->console("Fatal Error: Could not allocate PDU in reassemble_rx_sdus() (2)\n"); log->console("Fatal Error: Could not allocate PDU in reassemble_rx_sdus() (2)\n");
exit(-1); exit(-1);
#else #else
log->error("Fatal Error: Could not allocate PDU in reassemble_rx_sdus() (2)\n"); log->error("Fatal Error: Could not allocate PDU in reassemble_rx_sdus() (2)\n");
return; return;
#endif #endif
}
} else {
log->error("Cannot read %d bytes from rx_window. vr_r=%d, tailroom=%d bytes\n", len, rx_window[vr_r].buf->get_tailroom());
pool->deallocate(rx_sdu);
goto exit;
} }
} else { } else {
log->error("Cannot fit RLC PDU in SDU buffer, dropping both.\n"); log->error("Cannot fit RLC PDU in SDU buffer, dropping both.\n");
pool->deallocate(rx_sdu); pool->deallocate(rx_sdu);
pool->deallocate(rx_window[vr_r].buf); goto exit;
rx_window.erase(vr_r);
} }
} }
// Handle last segment // Handle last segment
uint32_t len = rx_window[vr_r].buf->N_bytes; len = rx_window[vr_r].buf->N_bytes;
if (rx_sdu->get_tailroom() >= len) { if (rx_sdu->get_tailroom() >= len) {
memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len); memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len);
rx_sdu->N_bytes += rx_window[vr_r].buf->N_bytes; rx_sdu->N_bytes += rx_window[vr_r].buf->N_bytes;
@ -1246,6 +1252,7 @@ void rlc_am::reassemble_rx_sdus()
} }
} }
exit:
// Move the rx_window // Move the rx_window
pool->deallocate(rx_window[vr_r].buf); pool->deallocate(rx_window[vr_r].buf);
rx_window.erase(vr_r); rx_window.erase(vr_r);