fixeria has submitted this change. ( https://gerrit.osmocom.org/c/osmocom-bb/+/31739 ) Change subject: trxcon: do not crash on receipt of 8-PSK modulated bursts ...................................................................... trxcon: do not crash on receipt of 8-PSK modulated bursts TRXDv0 PDUs may have 2 additional dummy bytes at the end. Such a PDU will crash trxcon if it contains an 8-PSK modulated burst: Assert failed phybi->burst_len <= sizeof(bi.burst) In this case phybi->burst_len would be 444 + 2, while size of the burst buffer in struct l1sched_burst_ind is limited to the length of an 8-PSK modulated burst (444). Change-Id: Icfba986ccf0c696ba019b91575b4d69db001c14f --- M src/host/trxcon/src/trx_if.c 1 file changed, 37 insertions(+), 3 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve pespin: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/host/trxcon/src/trx_if.c b/src/host/trxcon/src/trx_if.c index 50c5c89..330fd62 100644 --- a/src/host/trxcon/src/trx_if.c +++ b/src/host/trxcon/src/trx_if.c @@ -645,9 +645,9 @@ return read_len; } - if (read_len < (TRXDv0_HDR_LEN + GSM_NBITS_NB_GMSK_BURST)) { + if (read_len < TRXDv0_HDR_LEN) { LOGPFSMSL(trx->fi, DTRXD, LOGL_ERROR, - "Got data message with invalid length '%zd'\n", read_len); + "Got malformed TRXD PDU (short length=%zd)\n", read_len); return -EINVAL; } @@ -657,6 +657,22 @@ return -ENOTSUP; } + read_len -= TRXDv0_HDR_LEN; + switch (read_len) { + /* TRXDv0 PDUs may have 2 dummy bytes at the end */ + case GSM_NBITS_NB_GMSK_BURST + 2: + case GSM_NBITS_NB_8PSK_BURST + 2: + read_len -= 2; + break; + case GSM_NBITS_NB_GMSK_BURST: + case GSM_NBITS_NB_8PSK_BURST: + break; + default: + LOGPFSMSL(trx->fi, DTRXD, LOGL_ERROR, + "Got TRXD PDU unexpected burst length=%zd\n", read_len); + return -EINVAL; + } + burst = (sbit_t *)&buf[8]; bi = (struct trxcon_phyif_burst_ind) { @@ -665,7 +681,7 @@ .rssi = -(int8_t) buf[5], .toa256 = (int16_t) (buf[6] << 8) | buf[7], .burst = burst, /* at least GSM_NBITS_NB_GMSK_BURST */ - .burst_len = read_len - TRXDv0_HDR_LEN, + .burst_len = read_len, }; /* Convert ubits {254..0} to sbits {-127..127} in-place */ -- To view, visit https://gerrit.osmocom.org/c/osmocom-bb/+/31739 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmocom-bb Gerrit-Branch: master Gerrit-Change-Id: Icfba986ccf0c696ba019b91575b4d69db001c14f Gerrit-Change-Number: 31739 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria &lt;vyanitskiy(a)sysmocom.de&gt; Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria &lt;vyanitskiy(a)sysmocom.de&gt; Gerrit-Reviewer: laforge &lt;laforge(a)osmocom.org&gt; Gerrit-Reviewer: pespin &lt;pespin(a)sysmocom.de&gt; Gerrit-MessageType: merged