fixeria has uploaded this change for review.

View Change

trxcon: fix uint8_t used for length in l1sched_prim_alloc()

Using uint8_t makes it impossible to allocate primitives with payload
of size 255 - sizeof(struct l1sched_ts_prim) and greater.

Change-Id: Ic19b8433118798f57500119f1caf10e117e5db19
Related: OS#5599, OS#3761
---
M src/host/trxcon/src/sched_prim.c
1 file changed, 1 insertion(+), 6 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/50/28550/1

diff --git a/src/host/trxcon/src/sched_prim.c b/src/host/trxcon/src/sched_prim.c
index 837c9fa..39eb923 100644
--- a/src/host/trxcon/src/sched_prim.c
+++ b/src/host/trxcon/src/sched_prim.c
@@ -49,7 +49,6 @@
 {
 	enum l1sched_lchan_type lchan_type;
 	struct l1sched_ts_prim *prim;
-	uint8_t len;
 
 	/* Determine lchan type */
 	lchan_type = l1sched_chan_nr2lchan_type(chan_nr, link_id);
@@ -59,12 +58,8 @@
 		return NULL;
 	}
 
-	/* How much memory do we need? */
-	len  = sizeof(struct l1sched_ts_prim); /* Primitive header */
-	len += pl_len; /* Requested payload size */
-
 	/* Allocate a new primitive */
-	prim = talloc_zero_size(ctx, len);
+	prim = talloc_zero_size(ctx, sizeof(*prim) + pl_len);
 	if (prim == NULL) {
 		LOGP(DSCH, LOGL_ERROR, "Failed to allocate memory\n");
 		return NULL;

To view, visit change 28550. To unsubscribe, or for help writing mail filters, visit settings.