fixeria has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email )

Change subject: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse() ......................................................................

gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()

The IPA CCM ID RESP TLV format uses a 16bit length field, and osmo_load16be() is used to read it, but t_len was declared as uint8_t, silently truncating any length above 255.

Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99 Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 1 insertion(+), 1 deletion(-)

Approvals: fixeria: Looks good to me, approved Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve pespin: Looks good to me, but someone else must approve

diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index 50fa31f..3e631de 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -209,7 +209,7 @@ * \returns 0 on success; negative on error */ int ipa_ccm_id_resp_parse(struct tlv_parsed *dec, const uint8_t *buf, unsigned int len) { - uint8_t t_len; + uint16_t t_len; uint8_t t_tag; const uint8_t *cur = buf;