pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/35856?usp=email ) Change subject: abis_nm_sw_act_req_ack: attr_len should be unsigned ...................................................................... abis_nm_sw_act_req_ack: attr_len should be unsigned Change-Id: I5c0ba76b5cc2464c7e362a850325c94770f38397 --- M include/osmocom/bsc/abis_nm.h M src/osmo-bsc/abis_nm.c 2 files changed, 17 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/56/35856/1 diff --git a/include/osmocom/bsc/abis_nm.h b/include/osmocom/bsc/abis_nm.h index 59a6dc9..f55c29c 100644 --- a/include/osmocom/bsc/abis_nm.h +++ b/include/osmocom/bsc/abis_nm.h @@ -87,7 +87,7 @@ int abis_nm_set_channel_attr(struct gsm_bts_trx_ts *ts, uint8_t chan_comb); int abis_nm_sw_act_req_ack(struct gsm_bts *bts, uint8_t obj_class, uint8_t i1, uint8_t i2, uint8_t i3, int nack, - const uint8_t *attr, int attr_len); + const uint8_t *attr, unsigned int attr_len); int abis_nm_raw_msg(struct gsm_bts *bts, int len, uint8_t *msg); int abis_nm_event_reports(struct gsm_bts *bts, int on); int abis_nm_reset_resource(struct gsm_bts *bts); diff --git a/src/osmo-bsc/abis_nm.c b/src/osmo-bsc/abis_nm.c index e8327dd..7a9789b 100644 --- a/src/osmo-bsc/abis_nm.c +++ b/src/osmo-bsc/abis_nm.c @@ -756,11 +756,16 @@ DEBUGPFOH(DNM, foh, "Software Activate Request, ACKing and Activating\n"); + if (oh->length < sizeof(*foh)) { + LOGPFOH(DNM, LOGL_ERROR, foh, "Software Activate Request with length too small: %u\n", oh->length); + return -EINVAL; + } + ret = abis_nm_sw_act_req_ack(sign_link->trx->bts, foh->obj_class, foh->obj_inst.bts_nr, foh->obj_inst.trx_nr, foh->obj_inst.ts_nr, 0, - foh->data, oh->length-sizeof(*foh)); + foh->data, oh->length - sizeof(*foh)); if (ret != 0) { LOGPFOH(DNM, LOGL_ERROR, foh, "Sending SW ActReq ACK failed: %d\n", ret); return ret; @@ -2165,7 +2170,7 @@ int abis_nm_sw_act_req_ack(struct gsm_bts *bts, uint8_t obj_class, uint8_t i1, uint8_t i2, uint8_t i3, int nack, - const uint8_t *attr, int attr_len) + const uint8_t *attr, unsigned int attr_len) { struct abis_om_hdr *oh; struct msgb *msg = nm_msgb_alloc(); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/35856?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I5c0ba76b5cc2464c7e362a850325c94770f38397 Gerrit-Change-Number: 35856 Gerrit-PatchSet: 1 Gerrit-Owner: pespin &lt;pespin(a)sysmocom.de&gt; Gerrit-MessageType: newchange