laforge uploaded patch set #2 to this change.
gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
cbsp_dec_write_repl() then takes the 8-bit page count straight off the
wire and uses it as the bound over an array of 16 entries, overflowing
the array on the heap.
Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Closes: OS#7053
---
M src/gsm/cbsp.c
1 file changed, 3 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/15/43215/2
To view, visit change 43215. To unsubscribe, or for help writing mail filters, visit settings.