diff options
| author | Pau Espin Pedrol <pespin@sysmocom.de> | 2017-04-12 16:11:50 +0200 |
|---|---|---|
| committer | Pau Espin Pedrol <pespin@sysmocom.de> | 2017-04-27 08:50:01 +0000 |
| commit | a67c47cab412b631c19e3f32167b9f5a0edc39ba (patch) | |
| tree | e185a4e78bf49ddbcf81553baf67517862904f3f | |
| parent | a15d00ca578a57a73e7612aaa9bdc02505b6cd12 (diff) | |
osmux: Check batch_factor overflow in osmux_batch_enqueue
This commit should fix a bug present if for instance batch_factor < 8
and osmux_batch_enqueue is called from osmux_replay_lost_packets and
enough packets were lost from last received packet.
Change-Id: I5d643810949aeca4762f0cad05eed534d35087f7
| -rw-r--r-- | src/osmux.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/src/osmux.c b/src/osmux.c index ae0bf26..1dcd04f 100644 --- a/src/osmux.c +++ b/src/osmux.c @@ -206,12 +206,13 @@ struct osmux_circuit { int dummy; }; -static int osmux_batch_enqueue(struct msgb *msg, struct osmux_circuit *circuit) +static int osmux_batch_enqueue(struct msgb *msg, struct osmux_circuit *circuit, + uint8_t batch_factor) { /* Too many messages per batch, discard it. The counter field of the * osmux header is just 3 bits long, so make sure it doesn't overflow. */ - if (circuit->nmsgs >= 8) { + if (circuit->nmsgs >= batch_factor || circuit->nmsgs >= 8) { struct rtp_hdr *rtph; rtph = osmo_rtp_get_hdr(msg); @@ -454,7 +455,7 @@ static int osmux_rtp_amr_payload_len(struct msgb *msg, struct rtp_hdr *rtph) } static void osmux_replay_lost_packets(struct osmux_circuit *circuit, - struct rtp_hdr *cur_rtph) + struct rtp_hdr *cur_rtph, int batch_factor) { int16_t diff; struct msgb *last; @@ -500,7 +501,7 @@ static void osmux_replay_lost_packets(struct osmux_circuit *circuit, DELTA_RTP_TIMESTAMP); /* No more room in this batch, skip padding with more clones */ - if (osmux_batch_enqueue(clone, circuit) < 0) { + if (osmux_batch_enqueue(clone, circuit, batch_factor) < 0) { msgb_free(clone); break; } @@ -609,10 +610,10 @@ osmux_batch_add(struct osmux_batch *batch, uint32_t batch_factor, struct msgb *m } } /* Handle RTP packet loss scenario */ - osmux_replay_lost_packets(circuit, rtph); + osmux_replay_lost_packets(circuit, rtph, batch_factor); /* This batch is full, force batch delivery */ - if (osmux_batch_enqueue(msg, circuit) < 0) + if (osmux_batch_enqueue(msg, circuit, batch_factor) < 0) return 1; #ifdef DEBUG_MSG |