From 42539b0bece976331dab8c965eb29fa525ac5def Mon Sep 17 00:00:00 2001
From: Cedric Roux <cedric.roux@eurecom.fr>
Date: Thu, 29 Aug 2024 14:59:51 +0200
Subject: [PATCH 1/2] rfsim: add a check on 'sock'

It is very possible that the operating system returns a file
descriptor bigger than the size of bridge->buf (MAX_FD_RFSIMU, which
is 250 as of now). As a minimum, let's fail if the socket file
descriptor is out of bounds.

A proper solution may be implemented later, if needed.
---
 radio/rfsimulator/simulator.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/radio/rfsimulator/simulator.c b/radio/rfsimulator/simulator.c
index d944e028bb..670998f57e 100644
--- a/radio/rfsimulator/simulator.c
+++ b/radio/rfsimulator/simulator.c
@@ -182,6 +182,8 @@ typedef struct {
 
 static int allocCirBuf(rfsimulator_state_t *bridge, int sock)
 {
+  /* TODO: cleanup code so that this AssertFatal becomes useless */
+  AssertFatal(sock >= 0 && sock < sizeofArray(bridge->buf), "socket %d is not in range\n", sock);
   buffer_t *ptr=&bridge->buf[sock];
   ptr->circularBuf = calloc(1, sampleToByte(CirSize, 1));
   if (ptr->circularBuf == NULL) {

From 532aa1a904bc847da869af796f73172ac2ac3e45 Mon Sep 17 00:00:00 2001
From: Cedric Roux <cedric.roux@eurecom.fr>
Date: Thu, 29 Aug 2024 15:06:29 +0200
Subject: [PATCH 2/2] rfsim: print error if write fails

Some strange behavior may happen if write() to the rfsim socket fails.
Let's print some error, can be useful in case of problem.
---
 radio/rfsimulator/simulator.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/radio/rfsimulator/simulator.c b/radio/rfsimulator/simulator.c
index 670998f57e..26feb13490 100644
--- a/radio/rfsimulator/simulator.c
+++ b/radio/rfsimulator/simulator.c
@@ -304,7 +304,12 @@ static void fullwrite(int fd, void *_buf, ssize_t count, rfsimulator_state_t *t)
   while (count) {
     l = write(fd, buf, count);
 
-    if (l <= 0) {
+    if (l == 0) {
+        LOG_E(HW, "write() failed, returned 0\n");
+        return;
+    }
+
+    if (l < 0) {
       if (errno==EINTR)
         continue;
 
@@ -312,8 +317,10 @@ static void fullwrite(int fd, void *_buf, ssize_t count, rfsimulator_state_t *t)
         LOG_D(HW, "write() failed, errno(%d)\n", errno);
         usleep(250);
         continue;
-      } else
+      } else {
+        LOG_E(HW, "write() failed, errno(%d)\n", errno);
         return;
+      }
     }
 
     count -= l;