fixeria has submitted this change. (
https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email )
Change subject: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()
......................................................................
gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()
The IPA CCM ID RESP TLV format uses a 16bit length field, and
osmo_load16be() is used to read it, but t_len was declared as
uint8_t, silently truncating any length above 255.
Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99
Related: OS#7050
---
M src/gsm/ipa.c
1 file changed, 1 insertion(+), 1 deletion(-)
Approvals:
fixeria: Looks good to me, approved
Jenkins Builder: Verified
laforge: Looks good to me, but someone else must approve
pespin: Looks good to me, but someone else must approve
diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c
index 50fa31f..3e631de 100644
--- a/src/gsm/ipa.c
+++ b/src/gsm/ipa.c
@@ -209,7 +209,7 @@
* \returns 0 on success; negative on error */
int ipa_ccm_id_resp_parse(struct tlv_parsed *dec, const uint8_t *buf, unsigned
int len)
{
- uint8_t t_len;
+ uint16_t t_len;
uint8_t t_tag;
const uint8_t *cur = buf;
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99
Gerrit-Change-Number: 43232
Gerrit-PatchSet: 2
Gerrit-Owner: fixeria <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
