Fixed out-of-bounds checking in rlc_um resegmentation

7 years ago · c2c637e06a
parent ba91a38da4
commit c2c637e06a
1 changed files with 4 additions and 4 deletions
--- a/lib/src/upper/rlc_um.cc
+++ b/lib/src/upper/rlc_um.cc
@ -513,10 +513,10 @@ void rlc_um::reassemble_rx_sdus()
    }
    
    // Handle last segment
-    // Handle last segment
-    if (rx_sdu->N_bytes < SRSLTE_MAX_BUFFER_SIZE_BYTES                 ||
-        rx_window[vr_ur].buf->N_bytes < SRSLTE_MAX_BUFFER_SIZE_BYTES   ||
-        rx_window[vr_ur].buf->N_bytes + rx_sdu->N_bytes < SRSLTE_MAX_BUFFER_SIZE_BYTES) {
+    if (rx_sdu->N_bytes                                 < SRSLTE_MAX_BUFFER_SIZE_BYTES   &&
+        rx_window[vr_ur].buf->N_bytes                   < SRSLTE_MAX_BUFFER_SIZE_BYTES   &&
+        rx_window[vr_ur].buf->N_bytes + rx_sdu->N_bytes < SRSLTE_MAX_BUFFER_SIZE_BYTES)
+    {

      memcpy(&rx_sdu->msg[rx_sdu->N_bytes], rx_window[vr_ur].buf->msg, rx_window[vr_ur].buf->N_bytes);
      rx_sdu->N_bytes += rx_window[vr_ur].buf->N_bytes;