Attention is currently required from: laforge.

laforge uploaded patch set #4 to this change.

View Change

The following approvals got outdated and were removed: Verified+1 by Jenkins Builder

The change is no longer submittable: Verified is unsatisfied now.

gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder

cbsp_dec_write_repl() then takes the 8-bit page count straight off the
wire and uses it as the bound over an array of 16 entries, overflowing
the array on the heap.

Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Closes: OS#7053
---
M src/gsm/cbsp.c
1 file changed, 5 insertions(+), 2 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/15/43215/4

To view, visit change 43215. To unsubscribe, or for help writing mail filters, visit settings.