Browse Source

smpp_mirror: Don't allocate msgb's for unrealistic amounts of memory

If the remote ESME would send us 0xffffffff as length field, don't try
to allocte 4GB of memory, but bail out.

Change-Id: I561f75210811826de06ea1673eca1df24faaa210
Fixes: CID#240738
changes/34/25934/2
Harald Welte 10 months ago committed by laforge
parent
commit
890ece1277
  1. 5
      src/utils/smpp_mirror.c

5
src/utils/smpp_mirror.c

@ -246,6 +246,10 @@ static int esme_read_cb(struct osmo_fd *ofd)
esme->read_idx += rc;
if (esme->read_idx >= sizeof(uint32_t)) {
esme->read_len = ntohl(len);
if (esme->read_len > 65535) {
/* unrealistic */
goto dead_socket;
}
msg = msgb_alloc(esme->read_len, "SMPP Rx");
if (!msg)
return -ENOMEM;
@ -283,6 +287,7 @@ dead_socket:
osmo_fd_unregister(&esme->wqueue.bfd);
close(esme->wqueue.bfd.fd);
esme->wqueue.bfd.fd = -1;
esme_read_state_reset(esme);
exit(2342);
return 0;

Loading…
Cancel
Save