path: root/openbsc
diff options
authorHolger Hans Peter Freyther <zecke@selfish.org>2011-02-10 11:41:49 +0100
committerHolger Hans Peter Freyther <zecke@selfish.org>2011-02-18 23:44:49 +0100
commit4446b3bf3439678beab10b067919e121a6499835 (patch)
tree423973143d24a5eb81a2a2d143b1938a60587d79 /openbsc
parent6e1a676e210b10899b34bf4bc9f391d52ddc8869 (diff)
nat: Add extra size check for the number and fail if it does not fit
If the replaced number is too long for the phone number we will have to stop processing here.
Diffstat (limited to 'openbsc')
1 files changed, 6 insertions, 0 deletions
diff --git a/openbsc/src/nat/bsc_nat_utils.c b/openbsc/src/nat/bsc_nat_utils.c
index aba082d4..b43d67a8 100644
--- a/openbsc/src/nat/bsc_nat_utils.c
+++ b/openbsc/src/nat/bsc_nat_utils.c
@@ -819,6 +819,12 @@ struct msgb *bsc_nat_rewrite_setup(struct bsc_nat *nat, struct msgb *msg, struct
return msg;
+ if (strlen(new_number) > sizeof(called.number)) {
+ LOGP(DNAT, LOGL_ERROR, "Number is too long for structure.\n");
+ talloc_free(new_number);
+ return msg;
+ }
* Need to create a new message now based on the old onew
* with a new number. We can sadly not patch this in place