• Michael Cook's avatar
    pdcp_fifo_flush_sdus: Fix message size calculation · 706f0e44
    Michael Cook authored
    -fsanitize=address detected that we were trying to access bytes
    past the end of a block of malloc'ed memory.
    
    Specifically, in this code:
    
    ```
        } else if (ENB_NAS_USE_TUN) {
          if( LOG_DEBUGFLAG(DEBUG_PDCP) )
            log_dump(PDCP, pdcpData, sizeToWrite, LOG_DUMP_CHAR,"PDCP
          output to be sent to TUN interface: \n");
          ret = write(nas_sock_fd[0], pdcpData, sizeToWrite);
    ```
    
    -fsanitize=address said:
    
    ```
    ==80==ERROR: AddressSanitizer: heap-buffer-overflow on address
    0x61100004ffdc at pc 0x7f57c5f576a5 bp 0x7f57bb53c240 sp
    0x7f57bb53b9e8
    READ of size 108 at 0x61100004ffdc thread T7
    
    0x61100004ffdc is located 0 bytes to the right of 220-byte region
    [0x61100004ff00,0x61100004ffdc)
    ```
    
    So, the code was trying to access the first byte after a block of
    heap memory.
    
    sizeToWrite was calculated like this:
    
    ```
        int sizeToWrite= sizeof (pdcp_data_ind_header_t) +
          pdcpHead->data_size;
    ```
    
    There were a few other similar invocations of write() in the same
    function used the wrong size.  That sizeToWrite calculation
    should be used only when the header is being sent, too, which
    happens in only one place in this function.
    
    With this commit, our tests pass and -fsanitize=address is happy.
    706f0e44
pdcp_fifo.c 37.8 KB