pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-netif/+/30756 )
Change subject: amr: osmo_amr_bwe_to_oa(): validate input data is long enough ......................................................................
amr: osmo_amr_bwe_to_oa(): validate input data is long enough
Change-Id: I2d11ce71c29ae046c2feab1e59045d97dc3e5099 --- M src/amr.c 1 file changed, 2 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-netif refs/changes/56/30756/1
diff --git a/src/amr.c b/src/amr.c index e4f0dd8..19557b3 100644 --- a/src/amr.c +++ b/src/amr.c @@ -221,6 +221,8 @@ ft = (bwe_hdr->ft_hi << 1) | bwe_hdr->ft_lo; if (!osmo_amr_ft_valid(ft)) return -1; + if ((10 + osmo_amr_bits(ft) + 7)/8 > payload_len) + return -1;
memset(buf, 0, sizeof(buf)); oa_hdr = (struct amr_hdr *)buf;