fixeria has uploaded this change for review.

View Change

gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()

The IPA CCM ID RESP TLV format uses a 16bit length field, and
osmo_load16be() is used to read it, but t_len was declared as
uint8_t, silently truncating any length above 255.

Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99
Related: OS#7050
---
M src/gsm/ipa.c
1 file changed, 1 insertion(+), 1 deletion(-)

git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/32/43232/1

diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c
index 50fa31f..3e631de 100644
--- a/src/gsm/ipa.c
+++ b/src/gsm/ipa.c
@@ -209,7 +209,7 @@
  *  \returns 0 on success; negative on error */
 int ipa_ccm_id_resp_parse(struct tlv_parsed *dec, const uint8_t *buf, unsigned int len)
 {
-	uint8_t t_len;
+	uint16_t t_len;
 	uint8_t t_tag;
 	const uint8_t *cur = buf;
 

To view, visit change 43232. To unsubscribe, or for help writing mail filters, visit settings.