Attention is currently required from: pespin.
jolly has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43293?usp=email )
Change subject: OM2K: Check bounds of OM2K Negotiation Request ......................................................................
Patch Set 1:
(1 comment)
File src/osmo-bsc/abis_om2000.c:
https://gerrit.osmocom.org/c/osmo-bsc/+/43293/comment/8e95d248_20002093?usp=... : PS1, Line 2777: uint8_t *cur = o2h->data+3;
You are accessing msg already here before the first check you added in 2785, are you sure this is co […]
o2h points to l2 pointer of msg. o2h->data points behind the o2h header. o2h->data+3 points 3 bytes after the o2h header. I am not accessing anything, just setting a pointer (cur) with an offset ahead of the l2 pointer of msg. This should not be a problem. Please correct me, if I am wrong.