diff options
| author | Holger Hans Peter Freyther <holger@moiji-mobile.com> | 2014-05-22 15:03:10 +0200 |
|---|---|---|
| committer | Holger Hans Peter Freyther <holger@moiji-mobile.com> | 2014-05-22 16:46:11 +0200 |
| commit | 1cc5ff8e19c840545ae746c52995d0768c2d1f70 (patch) | |
| tree | b9288badaf39184d9f015073e1fc8b792ce68de8 /openbsc/tests/mgcp | |
| parent | f259bd8359de61e9c8aa92c775b95665c1a143d5 (diff) | |
mgcp: Add proper length checking for line handling
In ae1997248ccb4fba1394267d3051082dfd85448a the handwritten tokenizer
was replaced with strtok_r. As part of this change the structural
checking of MGCP parameters was stopped. This means that a code like
"line + 3" might access beyond the first NUL and be possibly behind
the msgb. Manually add size checking again. Manually jumping to the
error label is not possible anymore as it has been removed. The result
is that invalid lines will be skipped. This is matching the general
approach by the IETF RFCs to be permissive in data being received.
Diffstat (limited to 'openbsc/tests/mgcp')
| -rw-r--r-- | openbsc/tests/mgcp/mgcp_test.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/openbsc/tests/mgcp/mgcp_test.c b/openbsc/tests/mgcp/mgcp_test.c index 498a1d8e6..53884833f 100644 --- a/openbsc/tests/mgcp/mgcp_test.c +++ b/openbsc/tests/mgcp/mgcp_test.c @@ -177,6 +177,7 @@ static void test_strline(void) #define CRCX "CRCX 2 1@mgw MGCP 1.0\r\n" \ "M: recvonly\r\n" \ "C: 2\r\n" \ + "X\r\n" \ "L: p:20\r\n" \ "\r\n" \ "v=0\r\n" \ |