fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email )
Change subject: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse() ......................................................................
gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()
The IPA CCM ID RESP TLV format uses a 16bit length field, and osmo_load16be() is used to read it, but t_len was declared as uint8_t, silently truncating any length above 255.
Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99 Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/32/43232/1
diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index 50fa31f..3e631de 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -209,7 +209,7 @@ * \returns 0 on success; negative on error */ int ipa_ccm_id_resp_parse(struct tlv_parsed *dec, const uint8_t *buf, unsigned int len) { - uint8_t t_len; + uint16_t t_len; uint8_t t_tag; const uint8_t *cur = buf;