From 993d911deb3e98baea1a811db059b1c201057709 Mon Sep 17 00:00:00 2001 From: roux Date: Wed, 2 Sep 2015 08:46:00 +0000 Subject: [PATCH] very dirty fix for some out of buffer memory access TO BE DONE PROPERLY AT SOME POINT!! git-svn-id: http://svn.eurecom.fr/openair4G/trunk@7791 818b1a75-f10b-46b9-bf7c-635c3b92a50f --- openair-cn/GTPV1-U/nw-gtpv1u/src/NwGtpv1u.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/openair-cn/GTPV1-U/nw-gtpv1u/src/NwGtpv1u.c b/openair-cn/GTPV1-U/nw-gtpv1u/src/NwGtpv1u.c index 95e1fec2b9..5308c0c86c 100644 --- a/openair-cn/GTPV1-U/nw-gtpv1u/src/NwGtpv1u.c +++ b/openair-cn/GTPV1-U/nw-gtpv1u/src/NwGtpv1u.c @@ -630,10 +630,15 @@ nwGtpv1uHandleEchoReq(NW_IN NwGtpv1uStackT *thiz, bufLen = sizeof(NwGtpv1uIeTv1T)+ ((NwGtpv1uMsgT*)hMsg)->msgLen; +#warning CROUX DIRTY +16, TO BE FIXED!!! + /* the +16 is there because by analyzing memory allocation with some external + * tool, I saw that there were 6 bytes accessed after bufLen in nwGtpv1uCreateAndSendMsg + * the value "16" has been chosen arbitrarily, just bigger than 6 + */ ((NwGtpv1uMsgT*)hMsg)->msgBuf = itti_malloc( TASK_GTPV1_U, TASK_UDP, - bufLen); + bufLen + 16 /* CROUX - dirty +16, to be fixed! */); ((NwGtpv1uMsgT*)hMsg)->msgBufLen = bufLen; NW_ASSERT(NW_GTPV1U_OK == rc);