From c915b08c75926bc45bb94eab3cc4626510b0e072 Mon Sep 17 00:00:00 2001
From: Kirill Andreev <andreev@iitp.ru>
Date: Wed, 8 Jul 2009 17:06:37 +0400
Subject: [PATCH] Fixed overflow

---
 src/devices/mesh/dot11s/ie-dot11s-perr.cc | 37 +++++++++++------------
 src/devices/mesh/dot11s/ie-dot11s-perr.h  |  2 +-
 src/devices/mesh/dot11s/ie-dot11s-preq.cc |  3 ++
 3 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/src/devices/mesh/dot11s/ie-dot11s-perr.cc b/src/devices/mesh/dot11s/ie-dot11s-perr.cc
index cea8ac281..1c7c17430 100644
--- a/src/devices/mesh/dot11s/ie-dot11s-perr.cc
+++ b/src/devices/mesh/dot11s/ie-dot11s-perr.cc
@@ -32,9 +32,8 @@ IePerr::~IePerr ()
 void
 IePerr::PrintInformation (std::ostream &os) const
 {
-  os << "Number of failed destinations: = " << m_numOfDest;
-  NS_ASSERT (m_numOfDest == m_addressUnits.size ());
-  for (unsigned int j = 0; j < m_numOfDest; j++)
+  os << "Number of failed destinations: = " << m_addressUnits.size ();
+  for (unsigned int j = 0; j < m_addressUnits.size (); j++)
     {
       os << "Failed destination address: = "<< m_addressUnits[j].destination <<
         ", sequence number = " << m_addressUnits[j].seqnum;
@@ -42,22 +41,20 @@ IePerr::PrintInformation (std::ostream &os) const
   os << "\n";
 
 }
-IePerr::IePerr ():
-    m_numOfDest (0)
+IePerr::IePerr ()
 {
 }
 uint8_t
 IePerr::GetNumOfDest ()
 {
-  return m_numOfDest;
+  return m_addressUnits.size ();
 }
 void
 IePerr::SerializeInformation (Buffer::Iterator i) const
 {
   i.WriteU8 (0);
-  i.WriteU8 (m_numOfDest);
-  NS_ASSERT (m_numOfDest == m_addressUnits.size ());
-  for (unsigned int j = 0; j < m_numOfDest; j++)
+  i.WriteU8 (m_addressUnits.size ());
+  for (unsigned int j = 0; j < m_addressUnits.size (); j++)
     {
       WriteTo (i, m_addressUnits[j].destination);
       i.WriteHtolsbU32 (m_addressUnits[j].seqnum);
@@ -68,10 +65,10 @@ IePerr::DeserializeInformation (Buffer::Iterator start, uint8_t length)
 {
   Buffer::Iterator i = start;
   i.Next (1); //Mode flags is not used now
-  m_numOfDest = i.ReadU8 ();
-  NS_ASSERT ((2+10*m_numOfDest) == length);
+  uint8_t numOfDest = i.ReadU8 ();
+  NS_ASSERT ((2+10*numOfDest) == length);
   length = 0; //to avoid compiler warning in optimized builds
-  for (unsigned int j = 0; j < m_numOfDest; j++)
+  for (unsigned int j = 0; j < numOfDest; j++)
     {
       FailedDestination unit;
       ReadFrom (i,unit.destination);
@@ -87,8 +84,7 @@ IePerr::GetInformationSize () const
   uint8_t retval =
      1 //ModeFlags
     +1 //NumOfDests
-    +6*m_numOfDest
-    +4*m_numOfDest;
+    +(6+4) * m_addressUnits.size ();
   return retval;
 }
 
@@ -98,10 +94,15 @@ IePerr::AddAddressUnit (FailedDestination unit)
   for (unsigned int i = 0; i < m_addressUnits.size (); i ++)
     if (m_addressUnits[i].destination == unit.destination)
       return;
+  if((m_addressUnits.size () + 1) * 10 + 2 > 255)
+    return;
   m_addressUnits.push_back (unit);
-  m_numOfDest++;
 }
-
+bool
+IePerr::IsFull () const
+{
+  return (GetSerializedSize () + 10 > 255);
+}
 std::vector<IePerr::FailedDestination>
 IePerr::GetAddressUnitVector () const
 {
@@ -113,7 +114,6 @@ IePerr::DeleteAddressUnit (Mac48Address address)
   for (std::vector<FailedDestination>::iterator i = m_addressUnits.begin (); i != m_addressUnits.end(); i ++)
     if (i->destination == address)
       {
-        m_numOfDest --;
         m_addressUnits.erase (i);
         break;
       }
@@ -135,12 +135,11 @@ IePerr::Merge(const IePerr perr)
 void
 IePerr::ResetPerr ()
 {
-  m_numOfDest = 0;
   m_addressUnits.clear ();
 }
 bool operator== (const IePerr & a, const IePerr & b)
 {
-  if(a.m_numOfDest != b.m_numOfDest)
+  if(a.m_addressUnits.size () != b.m_addressUnits.size ())
     return false;
   for(unsigned int i = 0; i < a.m_addressUnits.size(); i ++)
   {
diff --git a/src/devices/mesh/dot11s/ie-dot11s-perr.h b/src/devices/mesh/dot11s/ie-dot11s-perr.h
index 0e836071c..b1220d850 100644
--- a/src/devices/mesh/dot11s/ie-dot11s-perr.h
+++ b/src/devices/mesh/dot11s/ie-dot11s-perr.h
@@ -44,6 +44,7 @@ public:
   uint8_t   GetNumOfDest ();
 
   void AddAddressUnit (struct FailedDestination unit);
+  bool IsFull () const;
   std::vector<FailedDestination> GetAddressUnitVector () const;
   void DeleteAddressUnit (Mac48Address address);
   void Merge(const IePerr perr);
@@ -57,7 +58,6 @@ private:
   void PrintInformation (std::ostream& os) const;
   uint8_t  GetInformationSize () const;
 private:
-  uint8_t   m_numOfDest;
   std::vector<FailedDestination> m_addressUnits;
   friend bool operator== (const IePerr & a, const IePerr & b);
 };
diff --git a/src/devices/mesh/dot11s/ie-dot11s-preq.cc b/src/devices/mesh/dot11s/ie-dot11s-preq.cc
index 54d37fda1..a39f6fe37 100644
--- a/src/devices/mesh/dot11s/ie-dot11s-preq.cc
+++ b/src/devices/mesh/dot11s/ie-dot11s-preq.cc
@@ -336,6 +336,7 @@ IePreq::AddDestinationAddressElement (
   for (std::vector<Ptr<DestinationAddressUnit> >::const_iterator i = m_destinations.begin (); i != m_destinations.end(); i++ )
     if ((*i)->GetDestinationAddress () == dest_address)
       return;
+  //TODO: check overflow
   Ptr<DestinationAddressUnit>new_element = Create<DestinationAddressUnit> ();
   new_element->SetFlags (doFlag, rfFlag, false);
   new_element->SetDestinationAddress (dest_address);
@@ -409,6 +410,8 @@ IePreq::MayAddAddress (Mac48Address originator)
     return false;
   if(m_destinations[0]->GetDestinationAddress () == Mac48Address::GetBroadcast ())
     return false;
+  if(GetInformationSize () + 11 > 255)
+    return false;
   return true;
 }
 #ifdef RUN_SELF_TESTS