diff options
author | Vadim Yanitskiy <vyanitskiy@sysmocom.de> | 2020-05-23 17:24:37 +0700 |
---|---|---|
committer | Vadim Yanitskiy <vyanitskiy@sysmocom.de> | 2020-05-23 18:00:53 +0700 |
commit | c9915660ff41444b8af05ec57d7c7e832f49e273 (patch) | |
tree | aed5fb6329a9a57b266a516ce7f97ec1b1028106 /src | |
parent | 6fd47330418bec98b52f2893257e171631b2f472 (diff) |
csn1: fix M_CHOICE: restirct maximum length of the choice list
The current implementation is not capable of handling more than
256 (UCHAR_MAX) selectors in the choice list. Let's document
this and add a guard check to the M_CHOICE handler.
Change-Id: I40c3c5b9be892804c6cd71cbb907af469ce5d769
Diffstat (limited to 'src')
-rw-r--r-- | src/csn1.c | 2 | ||||
-rw-r--r-- | src/csn1.h | 3 |
2 files changed, 4 insertions, 1 deletions
@@ -495,6 +495,8 @@ csnStreamDecoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec *vector /* Make sure that the list of choice items is not empty */ if (!count) return ProcessError(readIndex, "csnStreamDecoder", CSN_ERROR_IN_SCRIPT, pDescr); + else if (count > 255) /* We can handle up to 256 (UCHAR_MAX) selectors */ + return ProcessError(readIndex, "csnStreamDecoder", CSN_ERROR_IN_SCRIPT, pDescr); while (count > 0) { @@ -490,7 +490,8 @@ gint16 csnStreamEncoder(csnStream_t* ar, const CSN_DESCR* pDescr, struct bitvec * is the part of the message. In the CSN_CHOICE case, this rule does not * apply. There is free but predefined mapping of the element of the union and * the value which addresses this element. - * The value of the address is called a selector. + * The value of the address is called a selector. Up to 256 (UCHAR_MAX) unique + * selectors can be handled, longer choice list would cause CSN_ERROR_IN_SCRIPT. * After unpacking, this value is then converted to the sequential number of the * element in the union and stored in the UnionType variable. * Par1: C structure name |