pespin has submitted this change. (
https://gerrit.osmocom.org/c/libosmo-netif/+/30693 )
Change subject: amr: osmo_amr_bwe_to_oa(): Modify loop to allow
osmo_amr_bytes()=0 (NO_DATA)
......................................................................
amr: osmo_amr_bwe_to_oa(): Modify loop to allow osmo_amr_bytes()=0 (NO_DATA)
oa_payload_len can be 2 if osmo_amr_bytes() returns 0 (it will return 0
when FT NO_DATA is supported). In tha case, the loop condition
(oa_payload_len - 3) (signed) is compared against unsigned i which ends
up accessing i=256.
Change-Id: I1e513f493d7883a03acbfa3d9744ec63657810b3
---
M src/amr.c
1 file changed, 4 insertions(+), 4 deletions(-)
Approvals:
Jenkins Builder: Verified
laforge: Looks good to me, but someone else must approve
osmith: Looks good to me, but someone else must approve
pespin: Looks good to me, approved
diff --git a/src/amr.c b/src/amr.c
index 1b750eb..8cd856d 100644
--- a/src/amr.c
+++ b/src/amr.c
@@ -214,11 +214,11 @@
return -1;
oa_payload_len = 2 + osmo_amr_bytes(oa_hdr->ft);
- for (i = 0; i < oa_payload_len - 3; i++) {
- buf[i + 2] = payload[i + 1] << 2;
- buf[i + 2] |= payload[i + 2] >> 6;
+ for (i = 2; i < oa_payload_len - 1; i++) {
+ buf[i] = payload[i - 1] << 2;
+ buf[i] |= payload[i] >> 6;
}
- buf[i + 2] = payload[i + 1] << 2;
+ buf[i] = payload[i - 1] << 2;
memcpy(payload, buf, oa_payload_len);
return oa_payload_len;
--
To view, visit https://gerrit.osmocom.org/c/libosmo-netif/+/30693
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings
Gerrit-Project: libosmo-netif
Gerrit-Branch: master
Gerrit-Change-Id: I1e513f493d7883a03acbfa3d9744ec63657810b3
Gerrit-Change-Number: 30693
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: osmith <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
Gerrit-MessageType: merged
