jolly has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmocom-bb/+/34555?usp=email )
Change subject: Add header length check to received CCCH messages ...................................................................... Add header length check to received CCCH messages Change-Id: I3bc6b0b997e6ea1048c3357d276adfcc1638b02b --- M src/host/layer23/src/mobile/gsm48_rr.c 1 file changed, 14 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/55/34555/1 diff --git a/src/host/layer23/src/mobile/gsm48_rr.c b/src/host/layer23/src/mobile/gsm48_rr.c index e5e2162..d725642 100644 --- a/src/host/layer23/src/mobile/gsm48_rr.c +++ b/src/host/layer23/src/mobile/gsm48_rr.c @@ -4856,6 +4856,11 @@ { struct gsm48_system_information_type_header *sih = msgb_l3(msg); + if (msgb_l3len(msg) < sizeof(*sih)) { + LOGP(DRR, LOGL_NOTICE, "Short read of CCCH message.\n"); + return -EINVAL; + } + switch (sih->system_information) { case GSM48_MT_RR_PAG_REQ_1: return gsm48_rr_rx_pag_req_1(ms, msg); -- To view, visit https://gerrit.osmocom.org/c/osmocom-bb/+/34555?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmocom-bb Gerrit-Branch: master Gerrit-Change-Id: I3bc6b0b997e6ea1048c3357d276adfcc1638b02b Gerrit-Change-Number: 34555 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andr...@eversberg.eu> Gerrit-MessageType: newchange