iu_helpers: check length before accessing buf

in ranap_transp_layer_addr_decode() we access the buffer buf before
checking the length field. This can lead to a segfault when the buffer
has a length of 0.

Change-Id: I983f6e5e4cee47b3f5719829e1310b8e2e33ffaf
changes/55/26855/1
Philipp Maier 1 year ago
parent ed1537e9cb
commit f3ab579e99
  1. 2
      src/iu_helpers.c

@ -113,7 +113,7 @@ int ranap_transp_layer_addr_decode(char *addr, unsigned int addr_len,
buf = trasp_layer_addr->buf;
len = trasp_layer_addr->size;
if (buf[0] == 0x35 && len >= 7)
if (len >= 7 && buf[0] == 0x35)
rc = inet_ntop(AF_INET, buf + 3, addr, addr_len);
else if (len > 3)
rc = inet_ntop(AF_INET, buf, addr, addr_len);

Loading…
Cancel
Save