trau_mux.c: Prevent out-of-bounds read in trau_decode_fr()
Haralds patch in 9f109dfb99
only fixed
the trau_encode_fr part but the issue seems to exist in the decode
function as well. Apply the same fix.
This commit is contained in:
parent
94f83e1787
commit
24fc435dad
|
@ -235,6 +235,9 @@ struct msgb *trau_decode_fr(uint32_t callref,
|
|||
o = 0; /* offset input bits */
|
||||
while (i < 260) {
|
||||
data[j/8] |= (tf->d_bits[k+o] << (7-(j%8)));
|
||||
/* to avoid out-of-bounds access in gsm_fr_map[++l] */
|
||||
if (i == 259)
|
||||
break;
|
||||
if (--k < 0) {
|
||||
o += gsm_fr_map[l];
|
||||
k = gsm_fr_map[++l]-1;
|
||||
|
|
Loading…
Reference in New Issue