laforge submitted this change.

View Change

Add missing length check in gsm48_decode_callerid()

Check if octet 3a is present in case it is expected. It is expected, if
the extension flag is set in octet 3.

Related: OS#7055
Change-Id: If40e318c24048a3727fa20684af32a8106f97f4a
---
M src/gsm/gsm48_ie.c
1 file changed, 2 insertions(+), 0 deletions(-)

diff --git a/src/gsm/gsm48_ie.c b/src/gsm/gsm48_ie.c
index 7a41ae8..e33e672 100644
--- a/src/gsm/gsm48_ie.c
+++ b/src/gsm/gsm48_ie.c
@@ -491,6 +491,8 @@
 
 	/* octet 3a */
 	if (!(lv[1] & 0x80)) {
+		if (in_len < 2)
+			return -EINVAL;
 		callerid->screen = lv[2] & 0x03;
 		callerid->present = (lv[2] & 0x60) >> 5;
 		i = 2;

To view, visit change 43227. To unsubscribe, or for help writing mail filters, visit settings.