Add check for rx_window tailroom

master
Ismael Gomez 7 years ago
parent 9d6c323001
commit 2a4a84a578

@ -1166,6 +1166,7 @@ void rlc_am::handle_control_pdu(uint8_t *payload, uint32_t nof_bytes)
void rlc_am::reassemble_rx_sdus() void rlc_am::reassemble_rx_sdus()
{ {
uint32_t len = 0;
if(!rx_sdu) { if(!rx_sdu) {
rx_sdu = pool_allocate; rx_sdu = pool_allocate;
if (!rx_sdu) { if (!rx_sdu) {
@ -1185,13 +1186,14 @@ void rlc_am::reassemble_rx_sdus()
// Handle any SDU segments // Handle any SDU segments
for(uint32_t i=0; i<rx_window[vr_r].header.N_li; i++) for(uint32_t i=0; i<rx_window[vr_r].header.N_li; i++)
{ {
uint32_t len = rx_window[vr_r].header.li[i]; len = rx_window[vr_r].header.li[i];
// sanity check to avoid zero-size SDUs // sanity check to avoid zero-size SDUs
if (len == 0) { if (len == 0) {
break; break;
} }
if (rx_sdu->get_tailroom() >= len) { if (rx_sdu->get_tailroom() >= len) {
if (rx_window[vr_r].buf->get_tailroom() >= len) {
memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len); memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len);
rx_sdu->N_bytes += len; rx_sdu->N_bytes += len;
rx_window[vr_r].buf->msg += len; rx_window[vr_r].buf->msg += len;
@ -1210,16 +1212,20 @@ void rlc_am::reassemble_rx_sdus()
return; return;
#endif #endif
} }
} else {
log->error("Cannot read %d bytes from rx_window. vr_r=%d, tailroom=%d bytes\n", len, rx_window[vr_r].buf->get_tailroom());
pool->deallocate(rx_sdu);
goto exit;
}
} else { } else {
log->error("Cannot fit RLC PDU in SDU buffer, dropping both.\n"); log->error("Cannot fit RLC PDU in SDU buffer, dropping both.\n");
pool->deallocate(rx_sdu); pool->deallocate(rx_sdu);
pool->deallocate(rx_window[vr_r].buf); goto exit;
rx_window.erase(vr_r);
} }
} }
// Handle last segment // Handle last segment
uint32_t len = rx_window[vr_r].buf->N_bytes; len = rx_window[vr_r].buf->N_bytes;
if (rx_sdu->get_tailroom() >= len) { if (rx_sdu->get_tailroom() >= len) {
memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len); memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_r].buf->msg, len);
rx_sdu->N_bytes += rx_window[vr_r].buf->N_bytes; rx_sdu->N_bytes += rx_window[vr_r].buf->N_bytes;
@ -1246,6 +1252,7 @@ void rlc_am::reassemble_rx_sdus()
} }
} }
exit:
// Move the rx_window // Move the rx_window
pool->deallocate(rx_window[vr_r].buf); pool->deallocate(rx_window[vr_r].buf);
rx_window.erase(vr_r); rx_window.erase(vr_r);

Loading…
Cancel
Save