diff options
Diffstat (limited to 'openbsc/src/gprs/gprs_gmm.c')
| -rw-r--r-- | openbsc/src/gprs/gprs_gmm.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c index 72d9e764b..bb61ab50a 100644 --- a/openbsc/src/gprs/gprs_gmm.c +++ b/openbsc/src/gprs/gprs_gmm.c @@ -648,7 +648,7 @@ static int gsm48_rx_gmm_att_req(struct sgsn_mm_ctx *ctx, struct msgb *msg, /* MS network capability 10.5.5.12 */ msnc_len = *cur++; msnc = cur; - if (msnc_len > 8) + if (msnc_len > sizeof(ctx->ms_network_capa.buf)) goto err_inval; cur += msnc_len; @@ -679,7 +679,7 @@ static int gsm48_rx_gmm_att_req(struct sgsn_mm_ctx *ctx, struct msgb *msg, /* MS Radio Access Capability 10.5.5.12a */ ms_ra_acc_cap_len = *cur++; ms_ra_acc_cap = cur; - if (ms_ra_acc_cap_len > 52) + if (ms_ra_acc_cap_len > sizeof(ctx->ms_radio_access_capa.buf)) goto err_inval; cur += ms_ra_acc_cap_len; @@ -740,8 +740,7 @@ static int gsm48_rx_gmm_att_req(struct sgsn_mm_ctx *ctx, struct msgb *msg, ctx->cell_id = cid; /* Update MM Context with other data */ ctx->drx_parms = drx_par; - ctx->ms_radio_access_capa.len = OSMO_MIN(ms_ra_acc_cap_len, - sizeof((ctx->ms_radio_access_capa.buf))); + ctx->ms_radio_access_capa.len = ms_ra_acc_cap_len; memcpy(ctx->ms_radio_access_capa.buf, ms_ra_acc_cap, ctx->ms_radio_access_capa.len); ctx->ms_network_capa.len = msnc_len; |