cellular-infrastructure
/
osmo-pcu
mirror of https://gerrit.osmocom.org/osmo-pcu
9
0
Fork 1
Code Issues Releases Wiki Activity

csn1: Properly verify CSN_BITMAP length 

Change-Id: I9f7672b534f9345caff99095504749eebad25adb
This commit is contained in:
Pau Espin 2020-03-26 20:29:53 +01:00 committed by laforge
parent f5e275aec0
commit c8280a538a
1 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/csn1.c
View File

@ -424,6 +424,10 @@ csnStreamDecoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec *vector
if (no_of_bits > 0) if (no_of_bits > 0)
{ {
if (no_of_bits > remaining_bits_len)
{
return ProcessError(readIndex, "csnStreamDecoder", CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, pDescr);
}
if (no_of_bits <= 32) if (no_of_bits <= 32)
{ {
@ -451,7 +455,6 @@ csnStreamDecoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec *vector
} }
remaining_bits_len -= no_of_bits; remaining_bits_len -= no_of_bits;
assert(remaining_bits_len >= 0);
bit_offset += no_of_bits; bit_offset += no_of_bits;
} }
/* bitmap was successfully extracted or it was empty */ /* bitmap was successfully extracted or it was empty */
@ -876,6 +879,10 @@ csnStreamDecoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec *vector
if (no_of_bits > 0) if (no_of_bits > 0)
{ {
if (no_of_bits > remaining_bits_len)
{
return ProcessError(readIndex, "csnStreamDecoder", CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, pDescr);
}
if (no_of_bits <= 32) if (no_of_bits <= 32)
{ {
@ -896,7 +903,6 @@ csnStreamDecoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec *vector
} }
remaining_bits_len -= no_of_bits; remaining_bits_len -= no_of_bits;
assert(remaining_bits_len >= 0);
bit_offset += no_of_bits; bit_offset += no_of_bits;
} }
/* bitmap was successfully extracted or it was empty */ /* bitmap was successfully extracted or it was empty */
@ -1737,6 +1743,10 @@ gint16 csnStreamEncoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec
if (no_of_bits > 0) if (no_of_bits > 0)
{ {
if (no_of_bits > remaining_bits_len)
{
return ProcessError(writeIndex, "csnStreamDecoder", CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, pDescr);
}
if (no_of_bits <= 32) if (no_of_bits <= 32)
{ {
@ -1762,7 +1772,6 @@ gint16 csnStreamEncoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec
} }
remaining_bits_len -= no_of_bits; remaining_bits_len -= no_of_bits;
assert(remaining_bits_len >= 0);
bit_offset += no_of_bits; bit_offset += no_of_bits;
} }
/* bitmap was successfully extracted or it was empty */ /* bitmap was successfully extracted or it was empty */
@ -2153,6 +2162,10 @@ gint16 csnStreamEncoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec
if (no_of_bits > 0) if (no_of_bits > 0)
{ {
if (no_of_bits > remaining_bits_len)
{
return ProcessError(writeIndex, "csnStreamDecoder", CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, pDescr);
}
if (no_of_bits <= 32) if (no_of_bits <= 32)
{ {
@ -2172,7 +2185,6 @@ gint16 csnStreamEncoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec
} }
remaining_bits_len -= no_of_bits; remaining_bits_len -= no_of_bits;
assert(remaining_bits_len >= 0);
bit_offset += no_of_bits; bit_offset += no_of_bits;
} }
/* bitmap was successfully extracted or it was empty */ /* bitmap was successfully extracted or it was empty */