jolly has uploaded this change for review. (
https://gerrit.osmocom.org/c/osmocom-bb/+/34555?usp=email )
Change subject: Add header length check to received CCCH messages
......................................................................
Add header length check to received CCCH messages
Change-Id: I3bc6b0b997e6ea1048c3357d276adfcc1638b02b
---
M src/host/layer23/src/mobile/gsm48_rr.c
1 file changed, 14 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/55/34555/1
diff --git a/src/host/layer23/src/mobile/gsm48_rr.c
b/src/host/layer23/src/mobile/gsm48_rr.c
index e5e2162..d725642 100644
--- a/src/host/layer23/src/mobile/gsm48_rr.c
+++ b/src/host/layer23/src/mobile/gsm48_rr.c
@@ -4856,6 +4856,11 @@
{
struct gsm48_system_information_type_header *sih = msgb_l3(msg);
+ if (msgb_l3len(msg) < sizeof(*sih)) {
+ LOGP(DRR, LOGL_NOTICE, "Short read of CCCH message.\n");
+ return -EINVAL;
+ }
+
switch (sih->system_information) {
case GSM48_MT_RR_PAG_REQ_1:
return gsm48_rr_rx_pag_req_1(ms, msg);
--
To view, visit https://gerrit.osmocom.org/c/osmocom-bb/+/34555?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings
Gerrit-Project: osmocom-bb
Gerrit-Branch: master
Gerrit-Change-Id: I3bc6b0b997e6ea1048c3357d276adfcc1638b02b
Gerrit-Change-Number: 34555
Gerrit-PatchSet: 1
Gerrit-Owner: jolly <andr...@eversberg.eu>
Gerrit-MessageType: newchange
