Skip to content

O
OpenXG-RAN
Commit c4167d8e authored by Haruki NAOI's avatar Haruki NAOI
Browse files
Options

Avoid Segfault with abnormal MAC header. 

(cherry picked from commit 04c5431468c9102dd625a73d9e5219b40b638fe3)
(cherry picked from commit 17880778c848406e562f98c20f7b7a6428502279)
(cherry picked from commit a26f44c197e854dd4261267a3695932392f09265)
parent e639f74a
Hide whitespace changes
Inline Side-by-side
Showing with 62 additions and 24 deletions
common/utils/asn1_conversions.h
View file @ c4167d8e
......@@ -33,7 +33,11 @@
*\return the extracted value.
*/
static inline uint8_t BIT_STRING_to_uint8(BIT_STRING_t *asn) {
DevCheck ((asn->size == 1), asn->size, 0, 0);
//DevCheck ((asn->size == 1), asn->size, 0, 0);
if(!(asn->size == 1)) {
printf("BIT_STRING_to_uint8 size %ld\n", asn->size);
return 0;
}
return asn->buf[0] >> asn->bits_unused;
}
......@@ -47,7 +51,11 @@ static inline uint16_t BIT_STRING_to_uint16(BIT_STRING_t *asn) {
uint16_t result = 0;
int index = 0;
DevCheck ((asn->size > 0) && (asn->size <= 2), asn->size, 0, 0);
//DevCheck ((asn->size > 0) && (asn->size <= 2), asn->size, 0, 0);
if(!((asn->size > 0) && (asn->size <= 2))) {
printf("BIT_STRING_to_uint16 size %ld\n", asn->size);
return 0;
}
switch (asn->size) {
case 2:
......@@ -74,7 +82,11 @@ static inline uint32_t BIT_STRING_to_uint32(BIT_STRING_t *asn) {
int index;
int shift;
DevCheck ((asn->size > 0) && (asn->size <= 4), asn->size, 0, 0);
//DevCheck ((asn->size > 0) && (asn->size <= 4), asn->size, 0, 0);
if(!((asn->size > 0) && (asn->size <= 4))) {
printf("BIT_STRING_to_uint32 size %ld\n", asn->size);
return 0;
}
shift = ((asn->size - 1) * 8) - asn->bits_unused;
for (index = 0; index < (asn->size - 1); index++) {
......@@ -97,7 +109,11 @@ static inline uint64_t BIT_STRING_to_uint64(BIT_STRING_t *asn) {
int index;
int shift;
DevCheck ((asn->size > 0) && (asn->size <= 8), asn->size, 0, 0);
//DevCheck ((asn->size > 0) && (asn->size <= 8), asn->size, 0, 0);
if(!((asn->size > 0) && (asn->size <= 8))) {
printf("BIT_STRING_to_uint64 size %ld\n", asn->size);
return 0;
}
shift = ((asn->size - 1) * 8) - asn->bits_unused;
for (index = 0; index < (asn->size - 1); index++) {
......
openair2/LAYER2/MAC/eNB_scheduler_ulsch.c
View file @ c4167d8e
......@@ -706,7 +706,7 @@ rx_sdu(const module_id_t enb_mod_idP,
switch (rx_lcids[i]) {
case CCCH:
if (rx_lengths[i] > CCCH_PAYLOAD_SIZE_MAX) {
if ((rx_lengths[i] > CCCH_PAYLOAD_SIZE_MAX) || (rx_lengths[i] < 0) || (rx_lengths[i] > sdu_lenP)) {
LOG_E(MAC, "[eNB %d/%d] frame %d received CCCH of size %d (too big, maximum allowed is %d, sdu_len %d), dropping packet\n",
enb_mod_idP,
CC_idP,
......@@ -843,6 +843,17 @@ rx_sdu(const module_id_t enb_mod_idP,
LOG_T(MAC, "\n");
#endif
if ((rx_lengths[i] > DCH_PAYLOAD_SIZE_MAX) || (rx_lengths[i] < 0) || (rx_lengths[i] > sdu_lenP)) {
LOG_E(MAC, "[eNB %d/%d] frame %d received DCCH of size %d (too big, maximum allowed is %d, sdu_len %d), dropping packet\n",
enb_mod_idP,
CC_idP,
frameP,
rx_lengths[i],
DCH_PAYLOAD_SIZE_MAX,
sdu_lenP);
break;
}
if (UE_id != -1) {
if (lcgid_updated[UE_template_ptr->lcgidmap[rx_lcids[i]]] == 0) {
/* Adjust buffer occupancy of the correponding logical channel group */
......@@ -892,6 +903,17 @@ rx_sdu(const module_id_t enb_mod_idP,
#endif
if (rx_lcids[i] < NB_RB_MAX) {
if ((rx_lengths[i] > SCH_PAYLOAD_SIZE_MAX) || (rx_lengths[i] < 0) || (rx_lengths[i] > sdu_lenP)) {
LOG_E(MAC, "[eNB %d/%d] frame %d received DTCH of size %d (too big, maximum allowed is %d, sdu_len %d), dropping packet\n",
enb_mod_idP,
CC_idP,
frameP,
rx_lengths[i],
DCH_PAYLOAD_SIZE_MAX,
sdu_lenP);
UE_list->eNB_UE_stats[CC_idP][UE_id].num_errors_rx += 1;
break;
}
LOG_D(MAC, "[eNB %d] CC_id %d Frame %d : ULSCH -> UL-DTCH, received %d bytes from UE %d for lcid %d\n",
enb_mod_idP,
CC_idP,
......@@ -901,6 +923,25 @@ rx_sdu(const module_id_t enb_mod_idP,
rx_lcids[i]);
if (UE_id != -1) {
ue_contextP = rrc_eNB_get_ue_context(RC.rrc[enb_mod_idP], current_rnti);
if (ue_contextP != NULL) {
if (ue_contextP->ue_context.DRB_active[rx_lcids[i] - 2] == 0) {
LOG_E(MAC, "[eNB %d/%d] frame %d received non active DTCH of size %d ( sdu_len %d, lcid %d), dropping packet\n",
enb_mod_idP,
CC_idP,
frameP,
rx_lengths[i],
sdu_lenP,rx_lcids[i]);
UE_list->eNB_UE_stats[CC_idP][UE_id].num_errors_rx += 1;
break;
}
}else{
LOG_E(MAC, "[eNB %d] CC_id %d Couldn't find the context associated to UE (RNTI %d) and reset RRC inactivity timer\n",
enb_mod_idP,
CC_idP,
current_rnti);
break;
}
/* Adjust buffer occupancy of the correponding logical channel group */
LOG_D(MAC, "[eNB %d] CC_id %d Frame %d : ULSCH -> UL-DTCH, received %d bytes from UE %d for lcid %d, removing from LCGID %ld, %d\n",
enb_mod_idP,
......@@ -929,7 +970,6 @@ rx_sdu(const module_id_t enb_mod_idP,
}
}
if ((rx_lengths[i] < SCH_PAYLOAD_SIZE_MAX) && (rx_lengths[i] > 0)) { // MAX SIZE OF transport block
mac_rlc_data_ind(enb_mod_idP, current_rnti, enb_mod_idP, frameP, ENB_FLAG_YES, MBMS_FLAG_NO, rx_lcids[i], (char *) payload_ptr, rx_lengths[i], 1, NULL);
UE_list->eNB_UE_stats[CC_idP][UE_id].num_pdu_rx[rx_lcids[i]] += 1;
UE_list->eNB_UE_stats[CC_idP][UE_id].num_bytes_rx[rx_lcids[i]] += rx_lengths[i];
......@@ -937,25 +977,7 @@ rx_sdu(const module_id_t enb_mod_idP,
UE_scheduling_control->uplane_inactivity_timer = 0;
/* Reset RRC inactivity timer after uplane activity */
ue_contextP = rrc_eNB_get_ue_context(RC.rrc[enb_mod_idP], current_rnti);
if (ue_contextP != NULL) {
ue_contextP->ue_context.ue_rrc_inactivity_timer = 1;
} else {
LOG_E(MAC, "[eNB %d] CC_id %d Couldn't find the context associated to UE (RNTI %d) and reset RRC inactivity timer\n",
enb_mod_idP,
CC_idP,
current_rnti);
}
} else { /* rx_length[i] Max size */
UE_list->eNB_UE_stats[CC_idP][UE_id].num_errors_rx += 1;
LOG_E(MAC, "[eNB %d] CC_id %d Frame %d : Max size of transport block reached LCID %d from UE %d ",
enb_mod_idP,
CC_idP,
frameP,
rx_lcids[i],
UE_id);
}
} else { // end if (UE_id != -1)
LOG_E(MAC,"[eNB %d] CC_id %d Frame %d : received unsupported or unknown LCID %d from UE %d ",
enb_mod_idP,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment