Merge branch 'hotfix-i2-galaxy-note-4' into 'develop'

fix size checks of CCCH

it was at the wrong place
it was also wrong (< instead of <=)

See merge request !25

openair2/LAYER2/MAC/eNB_scheduler_ulsch.c

@@ -229,6 +229,12 @@ void rx_sdu(
 
     switch (rx_lcids[i]) {
     case CCCH :
+      if (rx_lengths[i] > CCCH_PAYLOAD_SIZE_MAX) {
+        LOG_E(MAC, "[eNB %d/%d] frame %d received CCCH of size %d (too big, maximum allowed is %d), dropping packet\n",
+              enb_mod_idP, CC_idP, frameP, rx_lengths[i], CCCH_PAYLOAD_SIZE_MAX);
+        break;
+      }
+
       LOG_I(MAC,"[eNB %d][RAPROC] CC_id %d Frame %d, Received CCCH:  %x.%x.%x.%x.%x.%x, Terminating RA procedure for UE rnti %x\n",
             enb_mod_idP,CC_idP,frameP,
             payload_ptr[0],payload_ptr[1],payload_ptr[2],payload_ptr[3],payload_ptr[4], payload_ptr[5], rntiP);
@@ -302,8 +308,6 @@ void rx_sdu(
 #endif
 
       if (UE_id != -1) {
-        //  This check is just to make sure we didn't get a bogus SDU length, to be removed ...
-        if (rx_lengths[i]<CCCH_PAYLOAD_SIZE_MAX) {
         LOG_D(MAC,"[eNB %d] CC_id %d Frame %d : ULSCH -> UL-DCCH, received %d bytes form UE %d on LCID %d \n",
               enb_mod_idP,CC_idP,frameP, rx_lengths[i], UE_id, rx_lcids[i]);
 
@@ -321,7 +325,6 @@ void rx_sdu(
 			 NULL);//(unsigned int*)crc_status);
         UE_list->eNB_UE_stats[CC_idP][UE_id].num_pdu_rx[rx_lcids[i]]+=1;
         UE_list->eNB_UE_stats[CC_idP][UE_id].num_bytes_rx[rx_lcids[i]]+=rx_lengths[i];
-        }
       } /* UE_id != -1 */
 
       //      }