maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Coverity Scan CID 339892 (Overrunning array msg_p->ittiMsg.rrc_mac_ccch_data_ind.sdu of 512 bytes by passing it to a function which accesses it at byte offset 1022 using argument msg_p->ittiMsg.rrc_mac_ccch_data_ind.sdu_size (which evaluates to 1023).)

Browse Source
This commit is contained in:
Dong Anyuan
2019-05-28 20:31:03 +09:00
parent 0b48bb46be
commit 8c0db8086d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair2/RRC/LTE/rrc_eNB.c
+2 -2
View File
@@ -7736,9 +7736,9 @@ void *rrc_enb_process_itti_msg(void *notUsed) {
&ctxt,
RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size);
if (RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size >= RRC_BUFFER_SIZE_MAX) {
if (RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size >= CCCH_SDU_SIZE) {
LOG_I(RRC, "CCCH message has size %d > %d\n",
RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size,RRC_BUFFER_SIZE_MAX);
RRC_MAC_CCCH_DATA_IND(msg_p).sdu_size,CCCH_SDU_SIZE);
break;
}