summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHolger Hans Peter Freyther <zecke@selfish.org>2012-01-10 22:27:43 +0100
committerHolger Hans Peter Freyther <zecke@selfish.org>2012-01-10 22:27:43 +0100
commitc2c0ea700bc5100645372c94d765ddb2b6f99285 (patch)
tree868f8b48b5431ed3ec0d853b8575eee2b039c3b6
parent8c36fdb1d8938b7e453d626e363ee225a2845c4e (diff)
nat: Compare the DTAP L3 size with the size of the msgb - dtap header
-rw-r--r--openbsc/src/osmo-bsc_nat/bsc_nat_utils.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
index bf1417d94..93fb5b564 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
@@ -635,8 +635,10 @@ struct gsm48_hdr *bsc_unpack_dtap(struct bsc_nat_parsed *parsed,
return NULL;
}
- if (*len < sizeof(struct gsm48_hdr)) {
- LOGP(DNAT, LOGL_ERROR, "GSM48 header does not fit.\n");
+ if (msgb_l3len(msg) - 3 < msg->l3h[2]) {
+ LOGP(DNAT, LOGL_ERROR,
+ "GSM48 payload does not fit: %d %d\n",
+ msg->l3h[2], msgb_l3len(msg) - 3);
return NULL;
}