Hi,

libasan reports heap overflow in tetra-rx

To reproduce:

checkout latest osmo-tetra

optionally modify Makefile to add -DDEBUG to CFLAGS

make debug (compiling this on debian 12 using the prepackaged libosmocore)

dd if=/dev/zero of=testbits.bin bs=1k count=4

mkdir r

./tetra-rx -d r testbits.bin

[...] burst_sync_in: 64 bits, state 0 -> trying to find training sequence between bit 0 and 4032 burst_sync_in: 64 bits, state 0 -> trying to find training sequence between bit 0 and 4096 ================================================================= ==169038==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000001178 at pc 0x55e8c5b1acd0 bp 0x7ffee4666cf0 sp 0x7ffee4666ce8 READ of size 1 at 0x621000001178 thread T0 #0 0x55e8c5b1accf in tetra_find_train_seq phy/tetra_burst.c:294 #1 0x55e8c5b19d30 in tetra_burst_sync_in phy/tetra_burst_sync.c:75 #2 0x55e8c5b19917 in main /home/sq5bpf/tetra2/osmo-tetra-orig/src/tetra-rx.c:94 #3 0x7fc9714461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #4 0x7fc971446284 in __libc_start_main_impl ../csu/libc-start.c:360 #5 0x55e8c5b19540 in _start (/home/sq5bpf/tetra2/osmo-tetra-orig/src/tetra-rx+0xc540)

0x621000001178 is located 0 bytes to the right of 4216-byte region [0x621000000100,0x621000001178) allocated by thread T0 here: #0 0x7fc9716b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7fc971cb0d53 (/lib/x86_64-linux-gnu/libtalloc.so.2+0x5d53)

SUMMARY: AddressSanitizer: heap-buffer-overflow phy/tetra_burst.c:294 in tetra_find_train_seq Shadow bytes around the buggy address: 0x0c427fff81d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff81e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff81f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff8210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c427fff8220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa] 0x0c427fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

This is some off-by-one bug but not obvious to me while looking at the code.

Jacek