From 3c94c2c5975774282e49d2d9a1d2041b01c8378e Mon Sep 17 00:00:00 2001 From: Neels Hofmeyr Date: Mon, 14 Mar 2016 13:41:20 +0100 Subject: bsc_scan_msc_msg: check protocol discriminator The function assumed an MM protocol discriminator without verifying it. --- openbsc/src/osmo-bsc/osmo_bsc_filter.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'openbsc/src') diff --git a/openbsc/src/osmo-bsc/osmo_bsc_filter.c b/openbsc/src/osmo-bsc/osmo_bsc_filter.c index 2e2db8875..9d7a5ca5e 100644 --- a/openbsc/src/osmo-bsc/osmo_bsc_filter.c +++ b/openbsc/src/osmo-bsc/osmo_bsc_filter.c @@ -337,6 +337,7 @@ int bsc_scan_msc_msg(struct gsm_subscriber_connection *conn, struct msgb *msg) struct gsm_network *net; struct gsm48_loc_area_id *lai; struct gsm48_hdr *gh; + uint8_t pdisc; uint8_t mtype; int length = msgb_l3len(msg); @@ -348,6 +349,10 @@ int bsc_scan_msc_msg(struct gsm_subscriber_connection *conn, struct msgb *msg) gh = (struct gsm48_hdr *) msgb_l3(msg); length -= (const char *)&gh->data[0] - (const char *)gh; + pdisc = gsm48_hdr_pdisc(gh); + if (pdisc != GSM48_PDISC_MM) + return 0; + mtype = gsm48_hdr_msg_type(gh); net = conn->bts->network; msc = conn->sccp_con->msc; -- cgit v1.2.3