diff options
author | Holger Hans Peter Freyther <zecke@selfish.org> | 2012-01-10 22:27:43 +0100 |
---|---|---|
committer | Holger Hans Peter Freyther <zecke@selfish.org> | 2012-01-10 22:27:43 +0100 |
commit | c2c0ea700bc5100645372c94d765ddb2b6f99285 (patch) | |
tree | 868f8b48b5431ed3ec0d853b8575eee2b039c3b6 /openbsc | |
parent | 8c36fdb1d8938b7e453d626e363ee225a2845c4e (diff) |
nat: Compare the DTAP L3 size with the size of the msgb - dtap header
Diffstat (limited to 'openbsc')
-rw-r--r-- | openbsc/src/osmo-bsc_nat/bsc_nat_utils.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c index bf1417d94..93fb5b564 100644 --- a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c +++ b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c @@ -635,8 +635,10 @@ struct gsm48_hdr *bsc_unpack_dtap(struct bsc_nat_parsed *parsed, return NULL; } - if (*len < sizeof(struct gsm48_hdr)) { - LOGP(DNAT, LOGL_ERROR, "GSM48 header does not fit.\n"); + if (msgb_l3len(msg) - 3 < msg->l3h[2]) { + LOGP(DNAT, LOGL_ERROR, + "GSM48 payload does not fit: %d %d\n", + msg->l3h[2], msgb_l3len(msg) - 3); return NULL; } |