osmocom
/
libosmocore
mirror of https://gerrit.osmocom.org/libosmocore
11
0
Fork 0
Code Issues Releases Wiki Activity

msgb: Assert len >= 0 in msgb_trim 

Currently msgb_trim only checks for len > data_len and returns -1
in that case, allowing the caller to fix it somehow. Using a negative
length will always lead to a corrupt msgb, but this is not being
checked.

This commit adds a check for len < 0 and a conditional call to MSGB_ABORT.

Sponsored-by: On-Waves ehf
This commit is contained in:
Jacob Erlbeck 2015-11-27 13:26:19 +01:00 committed by Holger Hans Peter Freyther
parent 0a053ec506
commit ff42b26520
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/osmocom/core/msgb.h
View File

@ -373,6 +373,8 @@ static inline void msgb_reserve(struct msgb *msg, int len)
*/
static inline int msgb_trim(struct msgb *msg, int len)
{
if (len < 0)
MSGB_ABORT(msg, "Negative length is not allowed\n");
if (len > msg->data_len)
return -1;