From a9d77a5d603e6f210a8e633b620b78c9d6351304 Mon Sep 17 00:00:00 2001
From: "xianfeng.du" <xianfeng.du>
Date: Tue, 1 Aug 2023 19:08:29 +0800
Subject: [PATCH] fixed the msg_transfer issue

---
 app/src/msg_transfer_layer.c | 16 +++++++++++-----
 app/src/msg_transfer_queue.c |  5 +++++
 driver/rfic                  |  2 +-
 driver/tfu                   |  2 +-
 4 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/app/src/msg_transfer_layer.c b/app/src/msg_transfer_layer.c
index 8a65d84..9fe17fe 100644
--- a/app/src/msg_transfer_layer.c
+++ b/app/src/msg_transfer_layer.c
@@ -130,9 +130,9 @@ int32_t msg_transfer_send_start(int32_t handle_id, uint16_t cu_flag)
         UCP_PRINT_ERROR("msg_transfer_send_start,UNINITIALIZED_QUEUE");
         return UNINITIALIZED_QUEUE;
     }
-	msg_queue_dl_block_init(inst_id,que_id);
-
-    return SUCCESS;
+
+	int32_t ret = msg_queue_dl_block_init(inst_id,que_id);
+    return ret;
 }
 
 
@@ -156,11 +156,17 @@ int32_t msg_transfer_alloc_msg(int32_t handle_id, uint16_t cu_flag, uint32_t buf
 
     MsgQueueLocalMgt_t* pMsgQueueLocalMgt = get_msg_queue_local_mgt();
     MsgQueueLocalInfo_t* ch = (MsgQueueLocalInfo_t*)&pMsgQueueLocalMgt->localDlQueue[inst_id][que_id];
+
+	if (bufSize > ch->availableSize) {
+		UCP_PRINT_ERROR("msg_transfer_alloc_msg,OUT_OF_BLOCK_MEMORY");
+		return OUT_OF_BLOCK_MEMORY;
+	}
 
     if (0 == ch->msgCnt)
     {
         msg_queue_dl_alloc_buf(inst_id,que_id);
     }
+
     *(uint64_t *)buf = ch->bufAddr + ch->offset;
     *availableSize = ch->availableSize;
     *offset = ch->offset;
@@ -198,10 +204,10 @@ int32_t msg_transfer_send_end(int32_t handle_id, uint16_t cu_flag)
 {
     HandleId_t handler;
     handler.value= (uint32_t)handle_id;
-    //uint8_t port_id = handler.port_id;	
+    //uint8_t port_id = handler.port_id;
     uint8_t inst_id = handler.inst_id;
     uint8_t type_id = handler.type_id;
-	
+
     int8_t que_id = get_queue_id(type_id, cu_flag);
     if (que_id < 0)
     {
diff --git a/app/src/msg_transfer_queue.c b/app/src/msg_transfer_queue.c
index 4fd3ea7..ecc1db3 100644
--- a/app/src/msg_transfer_queue.c
+++ b/app/src/msg_transfer_queue.c
@@ -73,6 +73,11 @@ int32_t msg_queue_dl_block_init(uint8_t inst_id, uint8_t que_id)
     PetSmLocalMgt_t* pPetSmLocalMgt = get_pet_sm_local_mgt();
     MsgQueueCommonInfo_t* chCommon = pPetSmLocalMgt->pDlQueue[inst_id][que_id];
 
+	if((MSG_MBUF_HEAD_SIZE >= chCommon->bufSize) || (0 == ch->bufBase))
+	{
+		return UNINITIALIZED_QUEUE;
+	}
+
     ch->availableSize = chCommon->bufSize - MSG_MBUF_HEAD_SIZE;
     ch->offset = 0;
     ch->msgCnt = 0;
diff --git a/driver/rfic b/driver/rfic
index 99d6653..8ea4378 160000
--- a/driver/rfic
+++ b/driver/rfic
@@ -1 +1 @@
-Subproject commit 99d6653cd9acb4b2797ec3c36252f0c80dcf0895
+Subproject commit 8ea437815106d50f2230e0b3989f7f7174ac0fed
diff --git a/driver/tfu b/driver/tfu
index 7908793..7bd0c4a 160000
--- a/driver/tfu
+++ b/driver/tfu
@@ -1 +1 @@
-Subproject commit 7908793098da2a3fcc5da3f3f2831c84fe4947f7
+Subproject commit 7bd0c4a6b87b70cf28b0c47eea74b731c9e90e38