summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHarald Welte <laforge@gnumonks.org>2017-04-27 10:45:09 +0200
committerHarald Welte <laforge@gnumonks.org>2017-04-27 10:45:09 +0200
commit7c56ab30c9dfd8069f69946c8d8aed61aafbbf18 (patch)
tree9db3cae90c0e18809bc37f6a34721601b0a2a79e
parent17927de2ad892aa5802d118ab71f041db0732f53 (diff)
xua_rkm: Fix handling of RK Registration with multiple Routing Keys
RKM permits multiple routing key IEs to be inside a single Routing Key Registration message. We were trying to handle this, but the counter we used as array index into the 'newly_assigned_as' array was actually always kept at zero. Change-Id: I08a962d2f242cefb67fb2dc93818c1ed532e8990 Fixes: coverity CID#166991
-rw-r--r--src/xua_rkm.c13
1 files changed, 7 insertions, 6 deletions
diff --git a/src/xua_rkm.c b/src/xua_rkm.c
index 62abfdd..d2971bc 100644
--- a/src/xua_rkm.c
+++ b/src/xua_rkm.c
@@ -145,9 +145,9 @@ static void xua_rkm_send_dereg_req(struct osmo_ss7_asp *asp, uint32_t route_ctx)
/* SG: handle a single registration request IE (nested IEs in 'innner' */
static int handle_rkey_reg(struct osmo_ss7_asp *asp, struct xua_msg *inner,
- struct msgb *resp, struct osmo_ss7_as **newly_assigned_as)
+ struct msgb *resp, struct osmo_ss7_as **newly_assigned_as,
+ unsigned int max_nas_idx, unsigned int *nas_idx)
{
- unsigned int nas_idx = 0;
uint32_t rk_id, rctx, _tmode, dpc;
enum osmo_ss7_as_traffic_mode tmode;
struct osmo_ss7_as *as;
@@ -245,13 +245,13 @@ static int handle_rkey_reg(struct osmo_ss7_asp *asp, struct xua_msg *inner,
}
/* append to list of newly assigned as */
- if (nas_idx >= MAX_NEW_AS) {
+ if (*nas_idx >= max_nas_idx) {
osmo_ss7_route_destroy(rt);
osmo_ss7_as_destroy(as);
msgb_append_reg_res(resp, rk_id, M3UA_RKM_REG_ERR_INSUFF_RESRC, 0);
return -1;
}
- newly_assigned_as[nas_idx++] = as;
+ newly_assigned_as[(*nas_idx)++] = as;
} else {
/* not permitted to create dynamic RKM entries */
msgb_append_reg_res(resp, rk_id, M3UA_RKM_REG_ERR_PERM_DENIED, 0);
@@ -270,7 +270,7 @@ static int m3ua_rx_rkm_reg_req(struct osmo_ss7_asp *asp, struct xua_msg *xua)
struct xua_msg_part *part;
struct msgb *resp = m3ua_msgb_alloc(__func__);
struct osmo_ss7_as *newly_assigned_as[MAX_NEW_AS];
- unsigned int i;
+ unsigned int i, nas_idx = 0;
memset(newly_assigned_as, 0, sizeof(newly_assigned_as));
@@ -289,7 +289,8 @@ static int m3ua_rx_rkm_reg_req(struct osmo_ss7_asp *asp, struct xua_msg *xua)
}
/* handle single registration and append result to
* 'resp' */
- handle_rkey_reg(asp, inner, resp, newly_assigned_as);
+ handle_rkey_reg(asp, inner, resp, newly_assigned_as,
+ ARRAY_SIZE(newly_assigned_as), &nas_idx);
xua_msg_free(inner);
}