Change in libosmo-netif[master]: amr: osmo_amr_bwe_to_oa(): Modify loop to allow osmo_amr_bytes()=0 (N...

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-netif/+/30693 ) Change subject: amr: osmo_amr_bwe_to_oa(): Modify loop to allow osmo_amr_bytes()=0 (NO_DATA) ...................................................................... amr: osmo_amr_bwe_to_oa(): Modify loop to allow osmo_amr_bytes()=0 (NO_DATA) oa_payload_len can be 2 if osmo_amr_bytes() returns 0 (it will return 0 when FT NO_DATA is supported). In tha case, the loop condition (oa_payload_len - 3) (signed) is compared against unsigned i which ends up accessing i=256. Change-Id: I1e513f493d7883a03acbfa3d9744ec63657810b3 --- M src/amr.c 1 file changed, 4 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-netif refs/changes/93/30693/1 diff --git a/src/amr.c b/src/amr.c index 1b750eb..8cd856d 100644 --- a/src/amr.c +++ b/src/amr.c @@ -214,11 +214,11 @@ return -1; oa_payload_len = 2 + osmo_amr_bytes(oa_hdr->ft); - for (i = 0; i < oa_payload_len - 3; i++) { - buf[i + 2] = payload[i + 1] << 2; - buf[i + 2] |= payload[i + 2] >> 6; + for (i = 2; i < oa_payload_len - 1; i++) { + buf[i] = payload[i - 1] << 2; + buf[i] |= payload[i] >> 6; } - buf[i + 2] = payload[i + 1] << 2; + buf[i] = payload[i - 1] << 2; memcpy(payload, buf, oa_payload_len); return oa_payload_len; -- To view, visit https://gerrit.osmocom.org/c/libosmo-netif/+/30693 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmo-netif Gerrit-Branch: master Gerrit-Change-Id: I1e513f493d7883a03acbfa3d9744ec63657810b3 Gerrit-Change-Number: 30693 Gerrit-PatchSet: 1 Gerrit-Owner: pespin &lt;pespin(a)sysmocom.de&gt; Gerrit-MessageType: newchange