jolly has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmocom-bb/+/34555?usp=email )

Change subject: Add header length check to received CCCH messages ......................................................................

Add header length check to received CCCH messages

Change-Id: I3bc6b0b997e6ea1048c3357d276adfcc1638b02b --- M src/host/layer23/src/mobile/gsm48_rr.c 1 file changed, 14 insertions(+), 0 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/55/34555/1

diff --git a/src/host/layer23/src/mobile/gsm48_rr.c b/src/host/layer23/src/mobile/gsm48_rr.c index e5e2162..d725642 100644 --- a/src/host/layer23/src/mobile/gsm48_rr.c +++ b/src/host/layer23/src/mobile/gsm48_rr.c @@ -4856,6 +4856,11 @@ { struct gsm48_system_information_type_header *sih = msgb_l3(msg);

+ if (msgb_l3len(msg) < sizeof(*sih)) { + LOGP(DRR, LOGL_NOTICE, "Short read of CCCH message.\n"); + return -EINVAL; + } + switch (sih->system_information) { case GSM48_MT_RR_PAG_REQ_1: return gsm48_rr_rx_pag_req_1(ms, msg);