[MERGED] osmo-msc[master]: BSSAP: Return error code if COMPL L3 with no or too short L3...

[Harald Welte]

Harald Welte has submitted this change and it was merged.

Change subject: BSSAP: Return error code if COMPL L3 with no or too short L3 payload
......................................................................


BSSAP: Return error code if COMPL L3 with no or too short L3 payload

Change-Id: Ie3bf1351ed11a9eb261737c2da0361e632e7b6e5
---
M src/libmsc/a_iface_bssap.c
1 file changed, 6 insertions(+), 0 deletions(-)

Approvals:
  Harald Welte: Looks good to me, approved
  Jenkins Builder: Verified



diff --git a/src/libmsc/a_iface_bssap.c b/src/libmsc/a_iface_bssap.c
index 7e9eae8..f131eca 100644
--- a/src/libmsc/a_iface_bssap.c
+++ b/src/libmsc/a_iface_bssap.c
@@ -337,6 +337,12 @@
 	msg->l3h = (uint8_t*)TLVP_VAL(tp, GSM0808_IE_LAYER_3_INFORMATION);
 	msgb_l3trim(msg, TLVP_LEN(tp, GSM0808_IE_LAYER_3_INFORMATION));
 
+	if (msgb_l3len(msg) < sizeof(struct gsm48_hdr)) {
+		LOGP(DBSSAP, LOGL_ERROR, "COMPL_L3 with too short L3 (%d) -- discarding\n",
+		     msgb_l3len(msg));
+		return -ENODATA;
+	}
+
 	/* Create new subscriber context */
 	conn = subscr_conn_allocate_a(a_conn_info, network, lac, scu, a_conn_info->conn_id);
 

-- 
To view, visit https://gerrit.osmocom.org/7373
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: Ie3bf1351ed11a9eb261737c2da0361e632e7b6e5
Gerrit-PatchSet: 1
Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-Owner: Harald Welte <laforge at gnumonks.org>
Gerrit-Reviewer: Harald Welte <laforge at gnumonks.org>
Gerrit-Reviewer: Jenkins Builder