xan/patty
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix REJ handling when N(R) > V(S)

Browse source 
Changes:

    * Allow REJ handling to occur when the V(S) send state counter wraps
      to a value lower than indicated in the frame N(R) field

    * Fix tx_slot() in src/sock.c to not buffer overflow when the TX
      window is less than the maximum for the SABM/SABME mode
This commit is contained in:
XANTRONIX Development 2020-07-26 01:41:44 -04:00 • committed by XANTRONIX Industrial
parent 8a26cace95
commit 7fd8be445a
2 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/server.c
View file

@ -1337,13 +1337,18 @@ reply_dm:
static int handle_rej(patty_ax25_server *server, static int handle_rej(patty_ax25_server *server,
patty_ax25_sock *sock, patty_ax25_sock *sock,
patty_ax25_frame *frame) { patty_ax25_frame *frame) {
unsigned int i; unsigned int i,
end = sock->seq_send;
if (sock == NULL) { if (sock == NULL) {
return 0; return 0;
} }
for (i=frame->nr; i<sock->seq_send; i++) { if (frame->nr > end) {
end += (sock->mode == PATTY_AX25_SOCK_SABME)? 128: 8;
}
for (i=frame->nr; i<end; i++) {
if (patty_ax25_sock_resend(sock, i) < 0) { if (patty_ax25_sock_resend(sock, i) < 0) {
goto error_sock_resend; goto error_sock_resend;
} }

7
src/sock.c
View file

@ -66,8 +66,11 @@ static inline size_t tx_slots_size(patty_ax25_sock *sock) {
return sock->n_window_tx * tx_slot_size(sock); return sock->n_window_tx * tx_slot_size(sock);
} }
static inline void *tx_slot(patty_ax25_sock *sock, size_t i) { static inline void *tx_slot(patty_ax25_sock *sock, size_t seq) {
return (void *)((uint8_t *)sock->tx_slots + (i * tx_slot_size(sock))); size_t win = sock->n_window_tx,
i = seq % win;
return (uint8_t *)sock->tx_slots + (i * tx_slot_size(sock));
} }
static int init_bufs(patty_ax25_sock *sock) { static int init_bufs(patty_ax25_sock *sock) {