diff options
| author | Philipp Maier <pmaier@sysmocom.de> | 2020-10-28 13:33:55 +0100 |
|---|---|---|
| committer | Philipp Maier <pmaier@sysmocom.de> | 2020-11-02 15:46:10 +0100 |
| commit | 484952a3e5e6453510840b2a15fe8f5fe8a7ea65 (patch) | |
| tree | c5cd796fb15606eacba828b51ef76e2c86443ddf | |
| parent | 90e01e47cbf811a560f128b5637d96207f41a2b8 (diff) | |
measurement.c: fix integer overflow problem
The variables num_meas_sub_expect - num_meas_sub must not be subtracted
without prior checking. Depending on the input (which might be
errornous), num_meas_sub might be greater then num_meas_sub_expect. This
eventually leads into odd behavior, which can be difficult to debug.
Change-Id: I381cc637d1c125f279ccf88db114609946fe24fe
Related: OS#4799
| -rw-r--r-- | src/common/measurement.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/common/measurement.c b/src/common/measurement.c index d5c3ee09..3813658d 100644 --- a/src/common/measurement.c +++ b/src/common/measurement.c @@ -642,7 +642,7 @@ int lchan_meas_check_compute(struct gsm_lchan *lchan, uint32_t fn) * negotiated in AMR, so we can not know if and how many * SUB frames are missing. */ if (lchan->tch_mode != GSM48_CMODE_SPEECH_AMR) { - if (num_ul_meas_expect - i <= num_meas_sub_expect - num_meas_sub) { + if (num_meas_sub <= i) { num_meas_sub_subst++; is_sub = true; } |