paulmataruso/openbts
1
0
Fork 0
mirror of https://github.com/RangeNetworks/openbts.git synced 2025-10-25 00:53:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

transceiver: Use length fields in UDP receive calls

Browse Source 
Update to match socket changes for buffer underrun prevention in
CommonLibs patch

"common: Add mandatory length field to UDP receive calls"

Reported-by: Simone Margaritelli <simone@zimperium.com>
Signed-off-by: Tom Tsou <tom.tsou@ettus.com>
This commit is contained in:
Tom Tsou
2016-05-02 17:56:32 -07:00
committed by Michael Iedema
parent 6f8bd14482
commit 30c652fe4f
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Transceiver52M/Transceiver.cpp
View File

@@ -470,7 +470,7 @@ void Transceiver::driveControl()
int msgLen = -1; int msgLen = -1;
buffer[0] = '\0'; buffer[0] = '\0';
msgLen = mControlSocket.read(buffer); msgLen = mControlSocket.read(buffer, sizeof(buffer));
if (msgLen < 1) { if (msgLen < 1) {
return; return;
@@ -661,7 +661,7 @@ bool Transceiver::driveTransmitPriorityQueue()
char buffer[gSlotLen+50]; char buffer[gSlotLen+50];
// check data socket // check data socket
size_t msgLen = mDataSocket.read(buffer); size_t msgLen = mDataSocket.read(buffer, sizeof(buffer));
if (msgLen!=gSlotLen+1+4+1) { if (msgLen!=gSlotLen+1+4+1) {
LOG(ERR) << "badly formatted packet on GSM->TRX interface"; LOG(ERR) << "badly formatted packet on GSM->TRX interface";

4
TransceiverRAD1/Transceiver.cpp
View File

@@ -463,7 +463,7 @@ void Transceiver::driveControl(unsigned ARFCN)
int msgLen = -1; int msgLen = -1;
buffer[0] = '\0'; buffer[0] = '\0';
msgLen = mControlSocket[ARFCN]->read(buffer); msgLen = mControlSocket[ARFCN]->read(buffer, sizeof(buffer));
mControlLock.lock(); mControlLock.lock();
@@ -725,7 +725,7 @@ bool Transceiver::driveTransmitPriorityQueue(unsigned ARFCN)
char buffer[gSlotLen+50]; char buffer[gSlotLen+50];
// check data socket // check data socket
size_t msgLen = mDataSocket[ARFCN]->read(buffer); size_t msgLen = mDataSocket[ARFCN]->read(buffer, sizeof(buffer));
ScopedLock lock(mTransmitPriorityQueueLock); ScopedLock lock(mTransmitPriorityQueueLock);