pdcp_fifo_flush_sdus: Fix message size calculation
-fsanitize=address detected that we were trying to access bytes past the end of a block of malloc'ed memory. Specifically, in this code: ``` } else if (ENB_NAS_USE_TUN) { if( LOG_DEBUGFLAG(DEBUG_PDCP) ) log_dump(PDCP, pdcpData, sizeToWrite, LOG_DUMP_CHAR,"PDCP output to be sent to TUN interface: \n"); ret = write(nas_sock_fd[0], pdcpData, sizeToWrite); ``` -fsanitize=address said: ``` ==80==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100004ffdc at pc 0x7f57c5f576a5 bp 0x7f57bb53c240 sp 0x7f57bb53b9e8 READ of size 108 at 0x61100004ffdc thread T7 0x61100004ffdc is located 0 bytes to the right of 220-byte region [0x61100004ff00,0x61100004ffdc) ``` So, the code was trying to access the first byte after a block of heap memory. sizeToWrite was calculated like this: ``` int sizeToWrite= sizeof (pdcp_data_ind_header_t) + pdcpHead->data_size; ``` There were a few other similar invocations of write() in the same function used the wrong size. That sizeToWrite calculation should be used only when the header is being sent, too, which happens in only one place in this function. With this commit, our tests pass and -fsanitize=address is happy.
Showing
Please register or sign in to comment