[PATCH] osmo-bts[master]: Check return value to prevent crash

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

Max gerrit-no-reply at lists.osmocom.org
Wed Sep 6 15:41:06 UTC 2017


Hello daniel, Neels Hofmeyr, Jenkins Builder,

I'd like you to reexamine a change.  Please visit

    https://gerrit.osmocom.org/3878

to look at the new patch set (#3).

Check return value to prevent crash

Previously result of readv() was used unconditionally so when it failed
and returned negative value it was treated like very large positive
which lead to memory corruption.

Change-Id: I956c8d551f45c9dd43b5e9de11dfe20dd8783647
Related: SYS#3865
---
M src/osmo-bts-litecell15/l1_transp_hw.c
M src/osmo-bts-sysmo/l1_transp_hw.c
2 files changed, 6 insertions(+), 2 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/osmo-bts refs/changes/78/3878/3

diff --git a/src/osmo-bts-litecell15/l1_transp_hw.c b/src/osmo-bts-litecell15/l1_transp_hw.c
index 6381864..38b9ffe 100644
--- a/src/osmo-bts-litecell15/l1_transp_hw.c
+++ b/src/osmo-bts-litecell15/l1_transp_hw.c
@@ -204,8 +204,10 @@
 		iov[i].iov_len = msgb_tailroom(msg[i]);
 	}
 
-
 	rc = readv(ofd->fd, iov, ARRAY_SIZE(iov));
+	if (rc < 0)
+		count = 0;
+
 	count = rc / prim_size;
 
 	for (i = 0; i < count; ++i) {
diff --git a/src/osmo-bts-sysmo/l1_transp_hw.c b/src/osmo-bts-sysmo/l1_transp_hw.c
index da8ac3f..c9f6861 100644
--- a/src/osmo-bts-sysmo/l1_transp_hw.c
+++ b/src/osmo-bts-sysmo/l1_transp_hw.c
@@ -215,8 +215,10 @@
 		iov[i].iov_len = msgb_tailroom(msg[i]);
 	}
 
-
 	rc = readv(ofd->fd, iov, ARRAY_SIZE(iov));
+	if (rc < 0)
+		count = 0;
+
 	count = rc / prim_size;
 
 	for (i = 0; i < count; ++i) {

-- 
To view, visit https://gerrit.osmocom.org/3878
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I956c8d551f45c9dd43b5e9de11dfe20dd8783647
Gerrit-PatchSet: 3
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Owner: Max <msuraev at sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: Max <msuraev at sysmocom.de>
Gerrit-Reviewer: Neels Hofmeyr <nhofmeyr at sysmocom.de>
Gerrit-Reviewer: Pau Espin Pedrol <pespin at sysmocom.de>
Gerrit-Reviewer: daniel <dwillmann at sysmocom.de>



More information about the gerrit-log mailing list