diff options
author | Andreas.Eversberg <jolly@eversberg.eu> | 2010-09-28 06:15:39 +0000 |
---|---|---|
committer | Andreas.Eversberg <jolly@eversberg.eu> | 2010-09-28 06:15:39 +0000 |
commit | 167648f2a5636ff1fb0c8c03d3f0781fa9c00aff (patch) | |
tree | 7da6b4f69c677bcdc0ce41db121b587eac2675a8 /src | |
parent | bd9cc54ad6ec7750c383995c36677abe66e6f601 (diff) |
[layer23] Fixed incorrect use of memcpy for frequency list IEs
Diffstat (limited to 'src')
-rw-r--r-- | src/host/layer23/src/mobile/gsm48_rr.c | 50 |
1 files changed, 25 insertions, 25 deletions
diff --git a/src/host/layer23/src/mobile/gsm48_rr.c b/src/host/layer23/src/mobile/gsm48_rr.c index 1b36717b..332ed830 100644 --- a/src/host/layer23/src/mobile/gsm48_rr.c +++ b/src/host/layer23/src/mobile/gsm48_rr.c @@ -3624,7 +3624,7 @@ static int gsm48_rr_rx_frq_redef(struct osmocom_ms *ms, struct msgb *msg) } /* mobile allocation */ - memcpy(&rr->cd_now.mob_alloc_lv, &fr->mob_alloc_len, + memcpy(rr->cd_now.mob_alloc_lv, &fr->mob_alloc_len, fr->mob_alloc_len + 1); /* starting time */ @@ -3634,11 +3634,11 @@ static int gsm48_rr_rx_frq_redef(struct osmocom_ms *ms, struct msgb *msg) /* cell channel description */ if (mob_al_len >= fr->mob_alloc_len + 2 + 17 && fr->mob_alloc[fr->mob_alloc_len + 2] == GSM48_IE_CELL_CH_DESC) { - const uint8_t *v = fr->mob_alloc + fr->mob_alloc_len + 3 + 1; + const uint8_t *v = fr->mob_alloc + fr->mob_alloc_len + 2 + 1; LOGP(DRR, LOGL_INFO, " using cell channel description)\n"); - memcpy(&cd.cell_desc_lv + 1, v, 17); cd.cell_desc_lv[0] = 16; + memcpy(cd.cell_desc_lv + 1, v, 17); } /* render channel "after time" */ @@ -3895,7 +3895,7 @@ static int gsm48_rr_rx_ass_cmd(struct osmocom_ms *ms, struct msgb *msg) LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n"); return -ENOMEM; } - memcpy(&cda->mob_alloc_lv, lv, *lv + 1); + memcpy(cda->mob_alloc_lv, lv, *lv + 1); } else if (TLVP_PRESENT(&tp, GSM48_IE_FREQ_L_AFTER)) { const uint8_t *lv = @@ -3907,7 +3907,7 @@ static int gsm48_rr_rx_ass_cmd(struct osmocom_ms *ms, struct msgb *msg) LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n"); return -ENOMEM; } - memcpy(&cda->freq_list_lv, lv, *lv + 1); + memcpy(cda->freq_list_lv, lv, *lv + 1); } else { LOGP(DRR, LOGL_NOTICE, " after: hopping required, but " "no mobile allocation / frequency list\n"); @@ -3926,7 +3926,7 @@ static int gsm48_rr_rx_ass_cmd(struct osmocom_ms *ms, struct msgb *msg) LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n"); return -ENOMEM; } - memcpy(&cdb->mob_alloc_lv, lv, *lv + 1); + memcpy(cdb->mob_alloc_lv, lv, *lv + 1); } else if (TLVP_PRESENT(&tp, GSM48_IE_FREQ_L_BEFORE)) { const uint8_t *lv = @@ -3938,7 +3938,7 @@ static int gsm48_rr_rx_ass_cmd(struct osmocom_ms *ms, struct msgb *msg) LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n"); return -ENOMEM; } - memcpy(&cdb->freq_list_lv, lv, *lv + 1); + memcpy(cdb->freq_list_lv, lv, *lv + 1); } else if (TLVP_PRESENT(&tp, GSM48_IE_F_CH_SEQ_BEFORE)) { const uint8_t *v = @@ -3952,20 +3952,20 @@ static int gsm48_rr_rx_ass_cmd(struct osmocom_ms *ms, struct msgb *msg) return -ENOMEM; } cdb->freq_seq_lv[0] = len; - memcpy(&cdb->freq_seq_lv + 1, v, len); + memcpy(cdb->freq_seq_lv + 1, v, len); } else if (cda->mob_alloc_lv[0]) { LOGP(DRR, LOGL_INFO, " before: hopping required and " "mobile allocation not available, using " "mobile allocation after time\n"); - memcpy(&cdb->mob_alloc_lv, &cda->mob_alloc_lv, + memcpy(cdb->mob_alloc_lv, cda->mob_alloc_lv, sizeof(cdb->mob_alloc_lv)); } else if (cda->freq_list_lv[0]) { LOGP(DRR, LOGL_INFO, " before: hopping required and " "frequency list not available, using " "frequency list after time\n"); - memcpy(&cdb->freq_list_lv, &cda->freq_list_lv, + memcpy(cdb->freq_list_lv, cda->freq_list_lv, sizeof(cdb->freq_list_lv)); } else { LOGP(DRR, LOGL_NOTICE, " before: hopping required, but " @@ -3985,14 +3985,14 @@ static int gsm48_rr_rx_ass_cmd(struct osmocom_ms *ms, struct msgb *msg) return -ENOMEM; } cdb->cell_desc_lv[0] = len; - memcpy(&cdb->cell_desc_lv + 1, v, len); + memcpy(cdb->cell_desc_lv + 1, v, len); cda->cell_desc_lv[0] = len; - memcpy(&cda->cell_desc_lv + 1, v, len); + memcpy(cda->cell_desc_lv + 1, v, len); } else { /* keep old */ - memcpy(&cdb->cell_desc_lv, &rr->cd_now.cell_desc_lv, + memcpy(cdb->cell_desc_lv, rr->cd_now.cell_desc_lv, sizeof(cdb->cell_desc_lv)); - memcpy(&cda->cell_desc_lv, &rr->cd_now.cell_desc_lv, + memcpy(cda->cell_desc_lv, rr->cd_now.cell_desc_lv, sizeof(cda->cell_desc_lv)); } @@ -4275,7 +4275,7 @@ static int gsm48_rr_rx_hando_cmd(struct osmocom_ms *ms, struct msgb *msg) LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n"); return -ENOMEM; } - memcpy(&cda->mob_alloc_lv, lv, *lv + 1); + memcpy(cda->mob_alloc_lv, lv, *lv + 1); } else if (TLVP_PRESENT(&tp, GSM48_IE_FREQ_L_AFTER)) { const uint8_t *lv = @@ -4287,7 +4287,7 @@ static int gsm48_rr_rx_hando_cmd(struct osmocom_ms *ms, struct msgb *msg) LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n"); return -ENOMEM; } - memcpy(&cda->freq_list_lv, lv, *lv + 1); + memcpy(cda->freq_list_lv, lv, *lv + 1); } else { LOGP(DRR, LOGL_NOTICE, " after: hopping required, but " "no mobile allocation / frequency list\n"); @@ -4306,7 +4306,7 @@ static int gsm48_rr_rx_hando_cmd(struct osmocom_ms *ms, struct msgb *msg) LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n"); return -ENOMEM; } - memcpy(&cdb->mob_alloc_lv, lv, *lv + 1); + memcpy(cdb->mob_alloc_lv, lv, *lv + 1); } else if (TLVP_PRESENT(&tp, GSM48_IE_FREQ_L_BEFORE)) { const uint8_t *lv = @@ -4318,7 +4318,7 @@ static int gsm48_rr_rx_hando_cmd(struct osmocom_ms *ms, struct msgb *msg) LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n"); return -ENOMEM; } - memcpy(&cdb->freq_list_lv, lv, *lv + 1); + memcpy(cdb->freq_list_lv, lv, *lv + 1); } else if (TLVP_PRESENT(&tp, GSM48_IE_F_CH_SEQ_BEFORE)) { const uint8_t *v = @@ -4332,20 +4332,20 @@ static int gsm48_rr_rx_hando_cmd(struct osmocom_ms *ms, struct msgb *msg) return -ENOMEM; } cdb->freq_seq_lv[0] = len; - memcpy(&cdb->freq_seq_lv, v + 1, *v); + memcpy(cdb->freq_seq_lv, v + 1, *v); } else if (cda->mob_alloc_lv[0]) { LOGP(DRR, LOGL_INFO, " before: hopping required and " "mobile allocation not available, using " "mobile allocation after time\n"); - memcpy(&cdb->mob_alloc_lv, &cda->mob_alloc_lv, + memcpy(cdb->mob_alloc_lv, cda->mob_alloc_lv, sizeof(cdb->mob_alloc_lv)); } else if (cda->freq_list_lv[0]) { LOGP(DRR, LOGL_INFO, " before: hopping required and " "frequency list not available, using " "frequency list after time\n"); - memcpy(&cdb->freq_list_lv, &cda->freq_list_lv, + memcpy(cdb->freq_list_lv, cda->freq_list_lv, sizeof(cdb->freq_list_lv)); } else { LOGP(DRR, LOGL_NOTICE, " before: hopping required, but " @@ -4365,14 +4365,14 @@ static int gsm48_rr_rx_hando_cmd(struct osmocom_ms *ms, struct msgb *msg) return -ENOMEM; } cdb->cell_desc_lv[0] = len; - memcpy(&cdb->cell_desc_lv + 1, v, len); + memcpy(cdb->cell_desc_lv + 1, v, len); cda->cell_desc_lv[0] = len; - memcpy(&cda->cell_desc_lv + 1, v, len); + memcpy(cda->cell_desc_lv + 1, v, len); } else { /* keep old */ - memcpy(&cdb->cell_desc_lv, &rr->cd_now.cell_desc_lv, + memcpy(cdb->cell_desc_lv, rr->cd_now.cell_desc_lv, sizeof(cdb->cell_desc_lv)); - memcpy(&cda->cell_desc_lv, &rr->cd_now.cell_desc_lv, + memcpy(cda->cell_desc_lv, rr->cd_now.cell_desc_lv, sizeof(cda->cell_desc_lv)); } |