Prevent segfault in range encoding
* Explicitly check when ARFCN array split is impossible and return
gracefully instead of using negative index.
* Separate range encoding into generic function and use it for all
SI-related things.
* Propagate the error into that function and to its callers.
* Add separate test-case for the segfault previously triggered by this bug.
Change-Id: I3e049ab2d7c1c4d6c791b148f37e10636a8e43e0
Related: RT#7379
diff --git a/openbsc/src/libbsc/arfcn_range_encode.c b/openbsc/src/libbsc/arfcn_range_encode.c
index 9918838..9ca4840 100644
--- a/openbsc/src/libbsc/arfcn_range_encode.c
+++ b/openbsc/src/libbsc/arfcn_range_encode.c
@@ -27,6 +27,8 @@
#include <osmocom/core/utils.h>
+#include <errno.h>
+
static inline int greatest_power_of_2_lesser_or_equal_to(int index)
{
int power_of_2 = 1;
@@ -109,6 +111,8 @@
/* Now do the processing */
split_at = range_enc_find_index(range, arfcns, size);
+ if (split_at < 0)
+ return -EINVAL;
/* we now know where to split */
out[index] = 1 + arfcns[split_at];