fixeria has submitted this change. ( https://gerrit.osmocom.org/c/osmocom-bb/+/28550 ) Change subject: trxcon: fix uint8_t used for length in l1sched_prim_alloc() ...................................................................... trxcon: fix uint8_t used for length in l1sched_prim_alloc() Using uint8_t makes it impossible to allocate primitives with payload of size 255 - sizeof(struct l1sched_ts_prim) and greater. Change-Id: Ic19b8433118798f57500119f1caf10e117e5db19 Related: OS#5599, OS#3761 --- M src/host/trxcon/src/sched_prim.c 1 file changed, 1 insertion(+), 6 deletions(-) Approvals: Jenkins Builder: Verified fixeria: Looks good to me, approved pespin: Looks good to me, but someone else must approve laforge: Looks good to me, but someone else must approve diff --git a/src/host/trxcon/src/sched_prim.c b/src/host/trxcon/src/sched_prim.c index a8e77fc..398cb9e 100644 --- a/src/host/trxcon/src/sched_prim.c +++ b/src/host/trxcon/src/sched_prim.c @@ -49,7 +49,6 @@ { enum l1sched_lchan_type lchan_type; struct l1sched_ts_prim *prim; - uint8_t len; /* Determine lchan type */ lchan_type = l1sched_chan_nr2lchan_type(chan_nr, link_id); @@ -59,12 +58,8 @@ return NULL; } - /* How much memory do we need? */ - len = sizeof(struct l1sched_ts_prim); /* Primitive header */ - len += pl_len; /* Requested payload size */ - /* Allocate a new primitive */ - prim = talloc_zero_size(ctx, len); + prim = talloc_zero_size(ctx, sizeof(*prim) + pl_len); if (prim == NULL) { LOGP(DSCH, LOGL_ERROR, "Failed to allocate memory\n"); return NULL; -- To view, visit https://gerrit.osmocom.org/c/osmocom-bb/+/28550 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmocom-bb Gerrit-Branch: master Gerrit-Change-Id: Ic19b8433118798f57500119f1caf10e117e5db19 Gerrit-Change-Number: 28550 Gerrit-PatchSet: 4 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged