tnt has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-e1d/+/27800 ) Change subject: RIFO: Fix issue in frame number bounds checking ...................................................................... RIFO: Fix issue in frame number bounds checking You can't have a 'min' and 'max' FN because of the wrap around this needs to be checked "all at once". Signed-off-by: Sylvain Munaut &lt;tnt(a)246tNt.com&gt; Change-Id: Ie9024f84f79b458248786bca2343a1f8bffb9994 --- M src/octoi/frame_rifo.c M src/octoi/frame_rifo.h 2 files changed, 5 insertions(+), 10 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-e1d refs/changes/00/27800/1 diff --git a/src/octoi/frame_rifo.c b/src/octoi/frame_rifo.c index 7e8ddf7..9f25cf0 100644 --- a/src/octoi/frame_rifo.c +++ b/src/octoi/frame_rifo.c @@ -112,7 +112,7 @@ uint32_t bucket; uint8_t *dst; - if (fn > frame_rifo_max_in_fn(rifo) && fn < frame_rifo_min_in_fn(rifo)) + if (!frame_rifo_fn_in_range(rifo, fn)) { return -ERANGE; } diff --git a/src/octoi/frame_rifo.h b/src/octoi/frame_rifo.h index f107537..6988710 100644 --- a/src/octoi/frame_rifo.h +++ b/src/octoi/frame_rifo.h @@ -13,16 +13,11 @@ indexed by physical offset in buf */ }; -/* maximum frame number we currently can store in the rifo */ -static inline uint32_t frame_rifo_max_in_fn(const struct frame_rifo *ff) +/* can this frame number be stores in the rifo */ +static inline bool frame_rifo_fn_in_range(const struct frame_rifo *ff, uint32_t fn) { - return ff->next_out_fn + FRAMES_PER_FIFO - 1; -} - -/* minimum frame number we currently can store in the rifo */ -static inline uint32_t frame_rifo_min_in_fn(const struct frame_rifo *ff) -{ - return ff->next_out_fn - 1; + uint32_t d = fn - ff->next_out_fn; + return d < FRAMES_PER_FIFO; } -- To view, visit https://gerrit.osmocom.org/c/osmo-e1d/+/27800 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-e1d Gerrit-Branch: master Gerrit-Change-Id: Ie9024f84f79b458248786bca2343a1f8bffb9994 Gerrit-Change-Number: 27800 Gerrit-PatchSet: 1 Gerrit-Owner: tnt &lt;tnt(a)246tNt.com&gt; Gerrit-MessageType: newchange