fixeria has submitted this change. ( https://gerrit.osmocom.org/c/osmo-trx/+/43736?usp=email )
Change subject: proxy: clck_gen_timer_cb(): sanitize expire_count ......................................................................
proxy: clck_gen_timer_cb(): sanitize expire_count
The number of timer expirations read from the timerfd is used as the loop boundary. It is already bounded indirectly by the PC clock skew check, but let's also check it explicitly against the same CLCK_GEN_MAX_FN_SKEW limit.
Change-Id: I55f736c9bff58034c197f876206efc817da30204 Fixes: CID#564331 --- M proxy/src/clck_gen.c 1 file changed, 10 insertions(+), 0 deletions(-)
Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, approved
diff --git a/proxy/src/clck_gen.c b/proxy/src/clck_gen.c index 39abc6c..2798b88 100644 --- a/proxy/src/clck_gen.c +++ b/proxy/src/clck_gen.c @@ -99,6 +99,16 @@ return 0; }
+ /* the number of expirations is also bounded by the skew limit */ + if (expire_count > CLCK_GEN_MAX_FN_SKEW) { + LOGP(DTRXC, LOGL_FATAL, + "Too many timer expirations (%" PRIu64 "): " + "stopping the TDMA clock generator\n", + expire_count); + clck_gen_stop(gen); + return 0; + } + while (expire_count-- > 0) { const struct proxy_trx *trx;