coverity CID#216830

sanity-check par->len received on the wire.

Change-Id: I3e6283154268f97a66b2b3f2ec8e3e9631424434
---
M src/sua.c
1 file changed, 4 insertions(+), 0 deletions(-)


git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/78/38178/1

diff --git a/src/sua.c b/src/sua.c
index 9e281e0..3d9d7ec 100644
--- a/src/sua.c
+++ b/src/sua.c
@@ -436,6 +436,10 @@
 		par = (struct xua_parameter_hdr *) &param->dat[pos];
 		par_tag = ntohs(par->tag);
 		par_len = ntohs(par->len);
+
+		/* sanity: check par->len received on the wire, make sure the subtraction does not wrap past zero. */
+		if (par_len < sizeof(*par))
+			goto subpar_fail;
 		par_datalen = par_len - sizeof(*par);
 
 		LOGP(DLSUA, LOGL_DEBUG, "SUA IEI 0x%04x pos %hu/%hu: subpart tag 0x%04x, len %hu\n",

