laforge has uploaded this change for review. (
https://gerrit.osmocom.org/c/osmo-bts/+/14876
Change subject: scheduler_trx: Deal with osmo_amr_rtp_enc() returning negative
......................................................................
scheduler_trx: Deal with osmo_amr_rtp_enc() returning negative
We cannot pass the possibly negative return value as length value to
_sched_compose_tch_ind() which would use it as the (unsigned) length
value of a memcpy.
Change-Id: I70ce98c5697b9ce6fac7ab57a5d70f3201db29d9
Closes: CID#178643
---
M src/osmo-bts-trx/scheduler_trx.c
1 file changed, 14 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-bts refs/changes/76/14876/1
diff --git a/src/osmo-bts-trx/scheduler_trx.c b/src/osmo-bts-trx/scheduler_trx.c
index ade3cff..22399c1 100644
--- a/src/osmo-bts-trx/scheduler_trx.c
+++ b/src/osmo-bts-trx/scheduler_trx.c
@@ -382,6 +382,10 @@
len = osmo_amr_rtp_enc(tch_data,
chan_state->codec[chan_state->dl_cmr],
chan_state->codec[chan_state->dl_ft], AMR_BAD);
+ if (len < 0) {
+ LOGL1S(DL1P, LOGL_ERROR, l1t, tn, chan, fn,
"Cannot encode AMR\n");
+ len = 0;
+ }
if (len < 2)
break;
memset(tch_data + 2, 0, len - 2);
@@ -1212,6 +1216,11 @@
chan_state->codec[chan_state->dl_cmr],
chan_state->codec[chan_state->dl_ft],
AMR_BAD);
+ if (rc < 0) {
+ LOGL1S(DL1P, LOGL_ERROR, l1t, tn, chan,
fn,
+ "Cannot encode AMR\n");
+ rc = 0;
+ }
if (rc < 2)
break;
memset(tch_data + 2, 0, rc - 2);
@@ -1393,6 +1402,11 @@
chan_state->codec[chan_state->dl_cmr],
chan_state->codec[chan_state->dl_ft],
AMR_BAD);
+ if (rc < 0) {
+ LOGL1S(DL1P, LOGL_ERROR, l1t, tn, chan,
fn,
+ "Cannot encode AMR\n");
+ rc = 0;
+ }
if (rc < 2)
break;
memset(tch_data + 2, 0, rc - 2);
--
To view, visit https://gerrit.osmocom.org/c/osmo-bts/+/14876
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Change-Id: I70ce98c5697b9ce6fac7ab57a5d70f3201db29d9
Gerrit-Change-Number: 14876
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <[email protected]>
Gerrit-MessageType: newchange
