Add header length check to received CCCH messages

Change-Id: I3bc6b0b997e6ea1048c3357d276adfcc1638b02b
---
M src/host/layer23/src/mobile/gsm48_rr.c
1 file changed, 14 insertions(+), 0 deletions(-)

diff --git a/src/host/layer23/src/mobile/gsm48_rr.c b/src/host/layer23/src/mobile/gsm48_rr.c
index e5e2162..d725642 100644
--- a/src/host/layer23/src/mobile/gsm48_rr.c
+++ b/src/host/layer23/src/mobile/gsm48_rr.c
@@ -4856,6 +4856,11 @@
 {
 	struct gsm48_system_information_type_header *sih = msgb_l3(msg);
 
+	if (msgb_l3len(msg) < sizeof(*sih)) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of CCCH message.\n");
+		return -EINVAL;
+	}
+
 	switch (sih->system_information) {
 	case GSM48_MT_RR_PAG_REQ_1:
 		return gsm48_rr_rx_pag_req_1(ms, msg);

