Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Overflow in bladeRF-cli number of samples #941

Closed
Algafix opened this issue Sep 13, 2023 · 0 comments
Closed

Overflow in bladeRF-cli number of samples #941

Algafix opened this issue Sep 13, 2023 · 0 comments

Comments

@Algafix
Copy link

Algafix commented Sep 13, 2023

Hello!

In bladeRF-cli, the n value in rx config (probably in tx too) overflows at 2**32:

rx config file=test.bin n=3G format=bin

  State: Running
  Channels: RX1
  Last error: None
  File: test.bin
  File format: SC8 Q7, Binary
  # Samples: 3221225472
----------------------------
rx config file=test.bin n=4G format=bin

  State: Running
  Channels: RX1
  Last error: None
  File: test.bin
  File format: SC8 Q7, Binary
  # Samples: infinite
----------------------------
rx config file=test.bin n=5G format=bin

  State: Running
  Channels: RX1
  Last error: None
  File: test.bin
  File format: SC8 Q7, Binary
  # Samples: 1073741824

In the code of rx.c:rx_cmd_config the variable n is declared as unsigned int. However, n_samples is declared as size_t which in my machine is long unsigned int.

Hence, changing the code form:

if (!strcasecmp("n", argv[i])) {
    /* Configure number of samples to receive */
    unsigned int n;
    bool ok;
    
    n = str2uint_suffix(val, 0, UINT_MAX, rxtx_kmg_suffixes,
                        (int)rxtx_kmg_suffixes_len, &ok);
    
    if (ok) {
        MUTEX_LOCK(&s->rx->param_lock);
        rx_params->n_samples = n;
        MUTEX_UNLOCK(&s->rx->param_lock);
} else {

to:

if (!strcasecmp("n", argv[i])) {
    /* Configure number of samples to receive */
    uint64_t n;
    bool ok;
    
    n = str2uint64_suffix(val, 0, UINT64_MAX, rxtx_kmg_suffixes,
                        (int)rxtx_kmg_suffixes_len, &ok);
    
    if (ok) {
        MUTEX_LOCK(&s->rx->param_lock);
        rx_params->n_samples = n;
        MUTEX_UNLOCK(&s->rx->param_lock);
}

Fixes it on my machine but not in one where size_t is just unsigned int.

rthomp10 added a commit that referenced this issue Sep 18, 2023
Result of val*mult would be casted to unsigned int before min/max
boundary check allowing for overflows to occur.

Fixes #941
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant