cellular-infrastructure
/
osmo-bsc
mirror of https://gerrit.osmocom.org/osmo-bsc
9
0
Fork 0
Code Issues Releases Wiki Activity

ipaccess-proxy: fix array bounds problem 

detected by Smatch:
/home/laforge/projects/git/openbsc/openbsc/src/ipaccess/ipaccess-proxy.c +173 store_idtags(14) error: buffer overflow 'ipbc->id_tags' 255 <= 255
/home/laforge/projects/git/openbsc/openbsc/src/ipaccess/ipaccess-proxy.c +173 store_idtags(14) error: buffer overflow 'ipbc->id_tags' 255 <= 255
/home/laforge/projects/git/openbsc/openbsc/src/ipaccess/ipaccess-proxy.c +175 store_idtags(16) error: buffer overflow 'ipbc->id_tags' 255 <= 255
/home/laforge/projects/git/openbsc/openbsc/src/ipaccess/ipaccess-proxy.c +178 store_idtags(19) error: buffer overflow 'ipbc->id_tags' 255 <= 255
/home/laforge/projects/git/openbsc/openbsc/src/ipaccess/ipaccess-proxy.c +500 ipaccess_rcvmsg(66) error: buffer overflow 'ipbc->rsl_conn' 4 <= 4
/home/laforge/projects/git/openbsc/openbsc/src/ipaccess/ipaccess-proxy.c +504 ipaccess_rcvmsg(70) error: buffer overflow 'ipbc->bsc_rsl_conn' 4
<= 4
This commit is contained in:
Harald Welte 2011-07-16 13:38:48 +02:00
parent 5b3c05d89a
commit 36ac775838
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
openbsc/src/ipaccess/ipaccess-proxy.c
View File

@ -103,7 +103,7 @@ struct ipa_bts_conn {
uint16_t gprs_orig_port;
uint32_t gprs_orig_ip;
char *id_tags[0xff];
char *id_tags[256];
uint8_t *id_resp;
unsigned int id_resp_len;
};
@ -488,7 +488,7 @@ static int ipaccess_rcvmsg(struct ipa_proxy_conn *ipc, struct msgb *msg,
return 0;
}
if (trx_id > MAX_TRX) {
if (trx_id >= MAX_TRX) {
LOGP(DINP, LOGL_ERROR, "We don't support more "
"than %u TRX\n", MAX_TRX);
return -EINVAL;