PentHertz
/
srsLTE
mirror of https://github.com/PentHertz/srsLTE.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix ASN1 s1ap code by checking upper bound of buffer

This commit is contained in:
Andre Puschmann 2018-01-31 15:05:17 +01:00
parent b24a1c8131
commit 8daa834607
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/src/asn1/liblte_s1ap.cc
View File

@ -2243,6 +2243,12 @@ LIBLTE_ERROR_ENUM liblte_s1ap_pack_imsi(
if(ie != NULL &&
ptr != NULL)
{
// max length of IE buffer is 32, so limit
if (ie->n_octets > 31) {
printf("Length in struct exceeds buffer (%d > 31).\n", ie->n_octets);
return LIBLTE_ERROR_ENCODE_FAIL;
}
// Dynamic octet string - IMSI
// Length
if(ie->n_octets < 128) {