fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmocom-bb/+/28550 )
Change subject: trxcon: fix uint8_t used for length in l1sched_prim_alloc() ......................................................................
trxcon: fix uint8_t used for length in l1sched_prim_alloc()
Using uint8_t makes it impossible to allocate primitives with payload of size 255 - sizeof(struct l1sched_ts_prim) and greater.
Change-Id: Ic19b8433118798f57500119f1caf10e117e5db19 Related: OS#5599, OS#3761 --- M src/host/trxcon/src/sched_prim.c 1 file changed, 1 insertion(+), 6 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/50/28550/1
diff --git a/src/host/trxcon/src/sched_prim.c b/src/host/trxcon/src/sched_prim.c index 837c9fa..39eb923 100644 --- a/src/host/trxcon/src/sched_prim.c +++ b/src/host/trxcon/src/sched_prim.c @@ -49,7 +49,6 @@ { enum l1sched_lchan_type lchan_type; struct l1sched_ts_prim *prim; - uint8_t len;
/* Determine lchan type */ lchan_type = l1sched_chan_nr2lchan_type(chan_nr, link_id); @@ -59,12 +58,8 @@ return NULL; }
- /* How much memory do we need? */ - len = sizeof(struct l1sched_ts_prim); /* Primitive header */ - len += pl_len; /* Requested payload size */ - /* Allocate a new primitive */ - prim = talloc_zero_size(ctx, len); + prim = talloc_zero_size(ctx, sizeof(*prim) + pl_len); if (prim == NULL) { LOGP(DSCH, LOGL_ERROR, "Failed to allocate memory\n"); return NULL;