iu_helpers: check length before accessing buf
in ranap_transp_layer_addr_decode() we access the buffer buf before checking the length field. This can lead to a segfault when the buffer has a length of 0. Change-Id: I983f6e5e4cee47b3f5719829e1310b8e2e33ffaf
This commit is contained in:
parent
ed1537e9cb
commit
f3ab579e99
|
@ -113,7 +113,7 @@ int ranap_transp_layer_addr_decode(char *addr, unsigned int addr_len,
|
||||||
buf = trasp_layer_addr->buf;
|
buf = trasp_layer_addr->buf;
|
||||||
len = trasp_layer_addr->size;
|
len = trasp_layer_addr->size;
|
||||||
|
|
||||||
if (buf[0] == 0x35 && len >= 7)
|
if (len >= 7 && buf[0] == 0x35)
|
||||||
rc = inet_ntop(AF_INET, buf + 3, addr, addr_len);
|
rc = inet_ntop(AF_INET, buf + 3, addr, addr_len);
|
||||||
else if (len > 3)
|
else if (len > 3)
|
||||||
rc = inet_ntop(AF_INET, buf, addr, addr_len);
|
rc = inet_ntop(AF_INET, buf, addr, addr_len);
|
||||||
|
|
Loading…
Reference in New Issue