summaryrefslogtreecommitdiffstats
path: root/openbsc
diff options
context:
space:
mode:
authorDaniel Willmann <daniel@totalueberwachung.de>2014-12-30 12:15:08 +0100
committerDaniel Willmann <daniel@totalueberwachung.de>2014-12-30 12:15:08 +0100
commit979ac860954459ea8707815abeda96274e3de27b (patch)
treea89412b3dbb5d63f08fe23d34ba9800ddc6ad966 /openbsc
parent695675f53991a33681ab1fa6662f318170f72992 (diff)
libbsc/chan_alloc: Fix size of pchan to hold the +CBCH channels as well
show net with an CCCH+SDCCH/4+CBCH channel active caused bts_chan_load to read from invalid memory. Fix this by making sure the pchan array is large enough. ==30346==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff9bdc5dc8 at pc 0x5aeece bp 0x7fff9bdc5350 sp 0x7fff9bdc5348 READ of size 4 at 0x7fff9bdc5dc8 thread T0 #0 0x5aeecd in bts_chan_load /home/alphaone/scm/osmo/openbsc/openbsc/src/libbsc/chan_alloc.c:490 #1 0x5af706 in network_chan_load /home/alphaone/scm/osmo/openbsc/openbsc/src/libbsc/chan_alloc.c:511 #2 0x4b7410 in net_dump_vty /home/alphaone/scm/osmo/openbsc/openbsc/src/libbsc/bsc_vty.c:208 #3 0x4b5f23 in show_net /home/alphaone/scm/osmo/openbsc/openbsc/src/libbsc/bsc_vty.c:227 #4 0x7fdabaa425bd in cmd_execute_command_real /home/alphaone/scm/osmo/libosmocore/src/vty/command.c:2042 #5 0x7fdabaa3f124 in cmd_execute_command /home/alphaone/scm/osmo/libosmocore/src/vty/command.c:2077 #6 0x7fdabaa850e9 in vty_command /home/alphaone/scm/osmo/libosmocore/src/vty/vty.c:402 #7 0x7fdabaa75962 in vty_execute /home/alphaone/scm/osmo/libosmocore/src/vty/vty.c:666 #8 0x7fdabaa6d947 in vty_read /home/alphaone/scm/osmo/libosmocore/src/vty/vty.c:1408 #9 0x7fdabaa9165f in client_data /home/alphaone/scm/osmo/libosmocore/src/vty/telnet_interface.c:119 #10 0x7fdaba7860b6 in osmo_select_main /home/alphaone/scm/osmo/libosmocore/src/select.c:160 #11 0x43c656 in main /home/alphaone/scm/osmo/openbsc/openbsc/src/osmo-nitb/bsc_hack.c:355 #12 0x7fdab92604bc (/lib64/libc.so.6+0x224bc) #13 0x43b6cc (/home/alphaone/local/osmo-asan/bin/osmo-nitb+0x43b6cc) Address 0x7fff9bdc5dc8 is located in stack of thread T0 at offset 232 in frame #0 0x4b5faf in net_dump_vty /home/alphaone/scm/osmo/openbsc/openbsc/src/libbsc/bsc_vty.c:182 This frame has 3 object(s): [32, 40) '' [96, 104) '' [160, 224) 'pl' HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow /home/alphaone/scm/osmo/openbsc/openbsc/src/libbsc/chan_alloc.c:490 bts_chan_load
Diffstat (limited to 'openbsc')
-rw-r--r--openbsc/include/openbsc/chan_alloc.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/openbsc/include/openbsc/chan_alloc.h b/openbsc/include/openbsc/chan_alloc.h
index f2d3c781d..4fc0b834d 100644
--- a/openbsc/include/openbsc/chan_alloc.h
+++ b/openbsc/include/openbsc/chan_alloc.h
@@ -54,7 +54,7 @@ struct load_counter {
};
struct pchan_load {
- struct load_counter pchan[GSM_PCHAN_UNKNOWN];
+ struct load_counter pchan[_GSM_PCHAN_MAX];
};
void bts_chan_load(struct pchan_load *cl, const struct gsm_bts *bts);