Commit 5885eadf authored by Cedric Roux's avatar Cedric Roux

Merge branch 'hotfix-i2-galaxy-note-4' into 'develop'

fix size checks of CCCH

it was at the wrong place
it was also wrong (< instead of <=)

See merge request !25
parents 21680ffb 0d7e510d
...@@ -229,6 +229,12 @@ void rx_sdu( ...@@ -229,6 +229,12 @@ void rx_sdu(
switch (rx_lcids[i]) { switch (rx_lcids[i]) {
case CCCH : case CCCH :
if (rx_lengths[i] > CCCH_PAYLOAD_SIZE_MAX) {
LOG_E(MAC, "[eNB %d/%d] frame %d received CCCH of size %d (too big, maximum allowed is %d), dropping packet\n",
enb_mod_idP, CC_idP, frameP, rx_lengths[i], CCCH_PAYLOAD_SIZE_MAX);
break;
}
LOG_I(MAC,"[eNB %d][RAPROC] CC_id %d Frame %d, Received CCCH: %x.%x.%x.%x.%x.%x, Terminating RA procedure for UE rnti %x\n", LOG_I(MAC,"[eNB %d][RAPROC] CC_id %d Frame %d, Received CCCH: %x.%x.%x.%x.%x.%x, Terminating RA procedure for UE rnti %x\n",
enb_mod_idP,CC_idP,frameP, enb_mod_idP,CC_idP,frameP,
payload_ptr[0],payload_ptr[1],payload_ptr[2],payload_ptr[3],payload_ptr[4], payload_ptr[5], rntiP); payload_ptr[0],payload_ptr[1],payload_ptr[2],payload_ptr[3],payload_ptr[4], payload_ptr[5], rntiP);
...@@ -302,26 +308,23 @@ void rx_sdu( ...@@ -302,26 +308,23 @@ void rx_sdu(
#endif #endif
if (UE_id != -1) { if (UE_id != -1) {
// This check is just to make sure we didn't get a bogus SDU length, to be removed ... LOG_D(MAC,"[eNB %d] CC_id %d Frame %d : ULSCH -> UL-DCCH, received %d bytes form UE %d on LCID %d \n",
if (rx_lengths[i]<CCCH_PAYLOAD_SIZE_MAX) { enb_mod_idP,CC_idP,frameP, rx_lengths[i], UE_id, rx_lcids[i]);
LOG_D(MAC,"[eNB %d] CC_id %d Frame %d : ULSCH -> UL-DCCH, received %d bytes form UE %d on LCID %d \n",
enb_mod_idP,CC_idP,frameP, rx_lengths[i], UE_id, rx_lcids[i]); mac_rlc_data_ind(
enb_mod_idP,
mac_rlc_data_ind( rntiP,
enb_mod_idP, enb_mod_idP,
rntiP, frameP,
enb_mod_idP, ENB_FLAG_YES,
frameP, MBMS_FLAG_NO,
ENB_FLAG_YES, rx_lcids[i],
MBMS_FLAG_NO, (char *)payload_ptr,
rx_lcids[i], rx_lengths[i],
(char *)payload_ptr, 1,
rx_lengths[i], NULL);//(unsigned int*)crc_status);
1, UE_list->eNB_UE_stats[CC_idP][UE_id].num_pdu_rx[rx_lcids[i]]+=1;
NULL);//(unsigned int*)crc_status); UE_list->eNB_UE_stats[CC_idP][UE_id].num_bytes_rx[rx_lcids[i]]+=rx_lengths[i];
UE_list->eNB_UE_stats[CC_idP][UE_id].num_pdu_rx[rx_lcids[i]]+=1;
UE_list->eNB_UE_stats[CC_idP][UE_id].num_bytes_rx[rx_lcids[i]]+=rx_lengths[i];
}
} /* UE_id != -1 */ } /* UE_id != -1 */
// } // }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment