diff options
| author | Harald Welte <laforge@gnumonks.org> | 2011-07-16 17:41:02 +0200 |
|---|---|---|
| committer | Harald Welte <laforge@gnumonks.org> | 2011-07-16 17:41:02 +0200 |
| commit | 48db968916514a9950fd1f8d43bbf389c39b1d53 (patch) | |
| tree | 3d06810cc17666285f2b0e9582d925e3ee26cf9b /src/host/layer23/include/osmocom/bb/mobile | |
| parent | eb77945e162ae1968242009372e448b7af51ea50 (diff) | |
settings.h: IMSI is 15 bytes +1 \0 maximum
If we use a larger field to store the IMSI, we can create overflows when
copying the imsi to other structures that are only 16 bytes in size.
Detected by Smatch:
src/host/layer23/src/mobile/subscriber.c +195 gsm_subscr_testcard(39) error: strcpy() 'set->test_imsi' too large for 'subscr->imsi' (20 vs 16)
Diffstat (limited to 'src/host/layer23/include/osmocom/bb/mobile')
| -rw-r--r-- | src/host/layer23/include/osmocom/bb/mobile/settings.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/host/layer23/include/osmocom/bb/mobile/settings.h b/src/host/layer23/include/osmocom/bb/mobile/settings.h index 7fa60894..20a8692e 100644 --- a/src/host/layer23/include/osmocom/bb/mobile/settings.h +++ b/src/host/layer23/include/osmocom/bb/mobile/settings.h @@ -21,10 +21,10 @@ struct gsm_settings { /* SIM */ int sim_type; /* selects card on power on */ - char emergency_imsi[20]; /* just in case... */ + char emergency_imsi[16]; /* test card simulator settings */ - char test_imsi[20]; /* just in case... */ + char test_imsi[16]; uint32_t test_tmsi; uint8_t test_ki_type; uint8_t test_ki[16]; /* 128 bit max */ |