diff options
| author | Pablo Neira Ayuso <pablo@gnumonks.org> | 2017-08-10 09:38:58 +0200 |
|---|---|---|
| committer | Neels Hofmeyr <neels@hofmeyr.de> | 2017-08-26 21:17:06 +0200 |
| commit | 12630afa293a4c285c6ce00476120bd9a0a2df67 (patch) | |
| tree | 1b06e5e99031d003a09ae63682ec522e97638ec3 | |
| parent | 43873b0e361f16351d66ddd1e106a35772e51df7 (diff) | |
libmsc: gsm340_gen_oa_sub() may return negative value
gsm340_gen_oa() returns a negative value if the output buffer that the
caller passes is too small, so we have to check the return value of this
function.
Fixes: CID 174178
Fixes: CID 174179
Change-Id: I47215d7d89771730a7f84efa8aeeb187a0911fdb
| -rw-r--r-- | src/libmsc/gsm_04_11.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/libmsc/gsm_04_11.c b/src/libmsc/gsm_04_11.c index 261e5cd64..eede74c23 100644 --- a/src/libmsc/gsm_04_11.c +++ b/src/libmsc/gsm_04_11.c @@ -215,9 +215,9 @@ static int gsm340_gen_sms_deliver_tpdu(struct msgb *msg, struct gsm_sms *sms) { uint8_t *smsp; uint8_t oa[12]; /* max len per 03.40 */ - uint8_t oa_len = 0; uint8_t octet_len; unsigned int old_msg_len = msg->len; + int oa_len; /* generate first octet with masked bits */ smsp = msgb_put(msg, 1); @@ -235,6 +235,9 @@ static int gsm340_gen_sms_deliver_tpdu(struct msgb *msg, struct gsm_sms *sms) /* generate originator address */ oa_len = gsm340_gen_oa_sub(oa, sizeof(oa), &sms->src); + if (oa_len < 0) + return -ENOSPC; + smsp = msgb_put(msg, oa_len); memcpy(smsp, oa, oa_len); @@ -284,9 +287,9 @@ static int gsm340_gen_sms_status_report_tpdu(struct msgb *msg, struct gsm_sms *sms) { unsigned int old_msg_len = msg->len; - uint8_t oa_len = 0; uint8_t oa[12]; /* max len per 03.40 */ uint8_t *smsp; + int oa_len; /* generate first octet with masked bits */ smsp = msgb_put(msg, 1); @@ -298,8 +301,12 @@ static int gsm340_gen_sms_status_report_tpdu(struct msgb *msg, /* TP-MR (message reference) */ smsp = msgb_put(msg, 1); *smsp = sms->msg_ref; + /* generate recipient address */ oa_len = gsm340_gen_oa_sub(oa, sizeof(oa), &sms->dst); + if (oa_len < 0) + return -ENOSPC; + smsp = msgb_put(msg, oa_len); memcpy(smsp, oa, oa_len); |