mirror of
				https://gitea.osmocom.org/cellular-infrastructure/osmo-mgw.git
				synced 2025-11-03 21:43:32 +00:00 
			
		
		
		
	ipaccess: Verify that the data fits in the package.
There is something wrong with the code, the length is here uint8_t but when we generate a IDGET we put it as 16bit data.
This commit is contained in:
		@@ -103,16 +103,23 @@ int ipaccess_idtag_parse(struct tlv_parsed *dec, unsigned char *buf, int len)
 | 
				
			|||||||
 | 
					
 | 
				
			||||||
	memset(dec, 0, sizeof(*dec));
 | 
						memset(dec, 0, sizeof(*dec));
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	while (cur < buf + len) {
 | 
						while (len >= 2) {
 | 
				
			||||||
 | 
							len -= 2;
 | 
				
			||||||
		t_len = *cur++;
 | 
							t_len = *cur++;
 | 
				
			||||||
		t_tag = *cur++;
 | 
							t_tag = *cur++;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
							if (t_len > len + 1) {
 | 
				
			||||||
 | 
								LOGP(DMI, LOGL_ERROR, "The tag does not fit: %d\n", t_len);
 | 
				
			||||||
 | 
								return -1;
 | 
				
			||||||
 | 
							}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
		DEBUGPC(DMI, "%s='%s' ", ipac_idtag_name(t_tag), cur);
 | 
							DEBUGPC(DMI, "%s='%s' ", ipac_idtag_name(t_tag), cur);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
		dec->lv[t_tag].len = t_len;
 | 
							dec->lv[t_tag].len = t_len;
 | 
				
			||||||
		dec->lv[t_tag].val = cur;
 | 
							dec->lv[t_tag].val = cur;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
		cur += t_len;
 | 
							cur += t_len;
 | 
				
			||||||
 | 
							len -= t_len;
 | 
				
			||||||
	}
 | 
						}
 | 
				
			||||||
	return 0;
 | 
						return 0;
 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 
 | 
				
			|||||||
		Reference in New Issue
	
	Block a user