cellular-infrastructure
/
osmo-iuh
mirror of https://gerrit.osmocom.org/osmo-iuh
9
0
Fork 0
Code Issues Releases Wiki Activity

iu_helpers: check length before accessing buf 

in ranap_transp_layer_addr_decode() we access the buffer buf before
checking the length field. This can lead to a segfault when the buffer
has a length of 0.

Change-Id: I983f6e5e4cee47b3f5719829e1310b8e2e33ffaf
This commit is contained in:
Philipp Maier 2022-01-10 12:55:59 +01:00
parent ed1537e9cb
commit f3ab579e99
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/iu_helpers.c
View File

@ -113,7 +113,7 @@ int ranap_transp_layer_addr_decode(char *addr, unsigned int addr_len,
buf = trasp_layer_addr->buf;
len = trasp_layer_addr->size;
if (buf[0] == 0x35 && len >= 7)
if (len >= 7 && buf[0] == 0x35)
rc = inet_ntop(AF_INET, buf + 3, addr, addr_len);
else if (len > 3)
rc = inet_ntop(AF_INET, buf, addr, addr_len);