maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update sdu_lenP to uint32_t in get_mac_len

Browse Source 
Add check in lcid_crnti_lookahead to ensure subtraction to pdu_len doesn't cause an underflow
This commit is contained in:
Rúben Soares Silva
2024-07-12 13:33:15 +01:00
parent 22ba6b751d
commit f58765d023
2 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair2/LAYER2/NR_MAC_COMMON/nr_mac.h
+6 -5
View File
@@ -107,12 +107,13 @@ typedef struct {
uint8_t R: 2; // octet 1 [7:6] uint8_t R: 2; // octet 1 [7:6]
} __attribute__ ((__packed__)) NR_MAC_SUBHEADER_FIXED; } __attribute__ ((__packed__)) NR_MAC_SUBHEADER_FIXED;
static inline int get_mac_len(uint8_t* pdu, int pdu_len, uint16_t *mac_ce_len, uint16_t *mac_subheader_len) { static inline int get_mac_len(uint8_t *pdu, uint32_t pdu_len, uint16_t *mac_ce_len, uint16_t *mac_subheader_len)
if ( pdu_len < (int)sizeof(NR_MAC_SUBHEADER_SHORT)) {
if (pdu_len < sizeof(NR_MAC_SUBHEADER_SHORT))
return false; return false;
NR_MAC_SUBHEADER_SHORT *s = (NR_MAC_SUBHEADER_SHORT*) pdu; NR_MAC_SUBHEADER_SHORT *s = (NR_MAC_SUBHEADER_SHORT *)pdu;
NR_MAC_SUBHEADER_LONG *l = (NR_MAC_SUBHEADER_LONG*) pdu; NR_MAC_SUBHEADER_LONG *l = (NR_MAC_SUBHEADER_LONG *)pdu;
if (s->F && pdu_len < (int)sizeof(NR_MAC_SUBHEADER_LONG)) if (s->F && pdu_len < sizeof(NR_MAC_SUBHEADER_LONG))
return false; return false;
if (s->F) { if (s->F) {
*mac_subheader_len = sizeof(*l); *mac_subheader_len = sizeof(*l);
openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_ulsch.c
+7 -1
View File
@@ -55,7 +55,13 @@ static rnti_t lcid_crnti_lookahead(uint8_t *pdu, uint32_t pdu_len)
break; break;
} }
pdu += mac_len + mac_subheader_len; pdu += mac_len + mac_subheader_len;
pdu_len -= mac_len + mac_subheader_len; // if pdu_len can have the value subtracted without underflow, we can subtract
if (pdu_len >= mac_len + mac_subheader_len) {
pdu_len -= mac_len + mac_subheader_len;
} else {
// if not, set to 0 to prevent underflow
pdu_len = 0;
}
} }
return 0; return 0;
} }