Fix length of FI freq list check

3 files changed, 21 insertions, 9 deletions

diff --git a/doc/servicelinking.mux b/doc/servicelinking.mux
index 438cb4e..e210c75 100644
--- a/doc/servicelinking.mux
+++ b/doc/servicelinking.mux
@@ -111,6 +111,7 @@ frequency_information {
             continuity true
             eid 0x4fff
             frequencies {
+                ; In DAB, max 2 frequency entries
                 entry_a {
                     signal_mode_1 true
                     adjacent true
@@ -127,6 +128,7 @@ frequency_information {
             range_modulation fm
             continuity true
             pi_code 0x1234
+            ; in FM, max 7 entries
             frequencies "87.6 105.2"
         }
     }
diff --git a/src/ConfigParser.cpp b/src/ConfigParser.cpp
index b48df8c..efcafbd 100644
--- a/src/ConfigParser.cpp
+++ b/src/ConfigParser.cpp
@@ -244,7 +244,7 @@ static void parse_freq_info(ptree& pt,
                                     }
                                     fle.fi_dab.frequencies.push_back(el);
                                 }
-                                if (fle.fi_dab.frequencies.size() > 7) {
+                                if (fle.fi_dab.frequencies.size() > 2) {
                                     throw runtime_error("Too many frequency entries in FI " + fle.uid);
                                 }
                             } break;
@@ -270,7 +270,7 @@ static void parse_freq_info(ptree& pt,
                                 for (std::string freq; std::getline(frequencies_ss, freq, ' '); ) {
                                     fle.fi_drm.frequencies.push_back(std::stof(freq));
                                 }
-                                if (fle.fi_drm.frequencies.size() > 7) {
+                                if (fle.fi_drm.frequencies.size() > 3) {
                                     throw runtime_error("Too many frequency entries in FI " + fle.uid);
                                 }
                             } break;
@@ -283,7 +283,7 @@ static void parse_freq_info(ptree& pt,
                                 for (std::string freq; std::getline(frequencies_ss, freq, ' '); ) {
                                     fle.fi_amss.frequencies.push_back(std::stof(freq));
                                 }
-                                if (fle.fi_amss.frequencies.size() > 7) {
+                                if (fle.fi_amss.frequencies.size() > 3) {
                                     throw runtime_error("Too many frequency entries in FI " + fle.uid);
                                 }
                             } break;
diff --git a/src/fig/FIG0_21.cpp b/src/fig/FIG0_21.cpp
index 1972a19..c9d5fab 100644
--- a/src/fig/FIG0_21.cpp
+++ b/src/fig/FIG0_21.cpp
@@ -27,6 +27,8 @@
 #include "fig/FIG0_21.h"
 #include "utils.h"
 
+using namespace std;
+
 namespace FIC {
 
 struct FIGtype0_21_header {
@@ -50,6 +52,14 @@ struct FIGtype0_21_fi_list_header {
         idHigh = id >> 8;
         idLow = id & 0xFF;
     }
+
+    void addToLength(uint8_t increment) {
+        const uint32_t newlen = length_freq_list + increment;
+        if (newlen > 0x7) {
+            throw logic_error("FI freq list too long: " + to_string(newlen));
+        }
+        length_freq_list = newlen;
+    }
 } PACKED;
 
 struct FIGtype0_21_fi_dab_entry {
@@ -209,7 +219,7 @@ FillStatus FIG0_21::fill(uint8_t *buf, size_t max_size)
                         field->setFreq(static_cast<uint32_t>(
                                     freq.frequency * 1000.0f / 16.0f));
 
-                        fi_list_header->length_freq_list += 3;
+                        fi_list_header->addToLength(3);
                         fig0->Length += 3;
                         buf += 3;
                         remaining -= 3;
@@ -226,7 +236,7 @@ FillStatus FIG0_21::fill(uint8_t *buf, size_t max_size)
                         // Do the whole calculation in kHz:
                         *buf = (freq * 1000.0f - 87500.0f) / 100.0f;
 
-                        fi_list_header->length_freq_list += 1;
+                        fi_list_header->addToLength(1);
                         fig0->Length += 1;
                         buf += 1;
                         remaining -= 1;
@@ -240,7 +250,7 @@ FillStatus FIG0_21::fill(uint8_t *buf, size_t max_size)
                     // Id field 2
                     *buf = (fle.fi_drm.drm_service_id >> 16) & 0xFF;
 
-                    fi_list_header->length_freq_list += 1;
+                    fi_list_header->addToLength(1);
                     fig0->Length += 1;
                     buf += 1;
                     remaining -= 1;
@@ -250,7 +260,7 @@ FillStatus FIG0_21::fill(uint8_t *buf, size_t max_size)
                         buf[0] = freq_field >> 8;
                         buf[1] = freq_field & 0xFF;
 
-                        fi_list_header->length_freq_list += 2;
+                        fi_list_header->addToLength(2);
                         fig0->Length += 2;
                         buf += 2;
                         remaining -= 2;
@@ -264,7 +274,7 @@ FillStatus FIG0_21::fill(uint8_t *buf, size_t max_size)
                     // Id field 2
                     *buf = (fle.fi_amss.amss_service_id >> 16) & 0xFF;
 
-                    fi_list_header->length_freq_list += 1;
+                    fi_list_header->addToLength(1);
                     fig0->Length += 1;
                     buf += 1;
                     remaining -= 1;
@@ -274,7 +284,7 @@ FillStatus FIG0_21::fill(uint8_t *buf, size_t max_size)
                         buf[0] = freq_field >> 8;
                         buf[1] = freq_field & 0xFF;
 
-                        fi_list_header->length_freq_list += 2;
+                        fi_list_header->addToLength(2);
                         fig0->Length += 2;
                         buf += 2;
                         remaining -= 2;