osmocom
/
libosmocore
mirror of https://gerrit.osmocom.org/libosmocore
11
0
Fork 0
Code Issues Releases Wiki Activity

cbsp: Fix decoding of WRITE-REPLACE payload 

The user length is the first IE *in* the fixed-length TV, make sure
cbsp_dec_write_repl() respects that.

Change-Id: I864cafac2466a89a4bd9644bc73363fff2babd03
This commit is contained in:
Harald Welte 2019-09-01 22:30:58 +02:00
parent 3097bcec58
commit e674c44c30
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/gsm/cbsp.c
View File

@ -687,8 +687,8 @@ static int cbsp_dec_write_repl(struct osmo_cbsp_write_replace *out, const struct
}
page = talloc_zero(ctx, struct osmo_cbsp_content);
OSMO_ASSERT(page);
page->user_len = *(ie-1); /* length byte before payload */
memcpy(page->data, ie, sizeof(page->data));
page->user_len = ie[0]; /* length byte before payload */
memcpy(page->data, ie+1, sizeof(page->data));
llist_add_tail(&page->list, &out->u.cbs.msg_content);
}
} else {