diff options
author | Holger Hans Peter Freyther <zecke@selfish.org> | 2010-10-14 20:42:45 +0200 |
---|---|---|
committer | Holger Hans Peter Freyther <zecke@selfish.org> | 2010-10-14 22:05:44 +0200 |
commit | d9e81d0fcf2b1a1064d5ee0031f5edc8f2ebf2c3 (patch) | |
tree | 786c312b13a1fe9926e7a08f9d561d0dfd77c88d /openbsc/src/input/ipaccess.c | |
parent | 949e0ba648ab0e8173ed4755e0158966acd1efc2 (diff) |
ipaccess: Verify that the data fits in the package.
There is something wrong with the code, the length is
here uint8_t but when we generate a IDGET we put it
as 16bit data.
Diffstat (limited to 'openbsc/src/input/ipaccess.c')
-rw-r--r-- | openbsc/src/input/ipaccess.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c index 74c850c9f..faa545830 100644 --- a/openbsc/src/input/ipaccess.c +++ b/openbsc/src/input/ipaccess.c @@ -103,16 +103,23 @@ int ipaccess_idtag_parse(struct tlv_parsed *dec, unsigned char *buf, int len) memset(dec, 0, sizeof(*dec)); - while (cur < buf + len) { + while (len >= 2) { + len -= 2; t_len = *cur++; t_tag = *cur++; + if (t_len > len + 1) { + LOGP(DMI, LOGL_ERROR, "The tag does not fit: %d\n", t_len); + return -1; + } + DEBUGPC(DMI, "%s='%s' ", ipac_idtag_name(t_tag), cur); dec->lv[t_tag].len = t_len; dec->lv[t_tag].val = cur; cur += t_len; + len -= t_len; } return 0; } |