Change in osmo-pcu[master]: pcu_l1_if: Check pag_req id_lv len fits buffer

[pespin]

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-pcu/+/16527 )


Change subject: pcu_l1_if: Check pag_req id_lv len fits buffer
......................................................................

pcu_l1_if: Check pag_req id_lv len fits buffer

Related: OS#4316
Change-Id: I803e1d2577a0d210e74feb5ca4c216375a5024ea
---
M src/pcu_l1_if.cpp
1 file changed, 8 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.osmocom.org:29418/osmo-pcu refs/changes/27/16527/1

diff --git a/src/pcu_l1_if.cpp b/src/pcu_l1_if.cpp
index 5e22c5c..98e697d 100644
--- a/src/pcu_l1_if.cpp
+++ b/src/pcu_l1_if.cpp
@@ -19,6 +19,7 @@
 
 #include <stdio.h>
 #include <unistd.h>
+#include <inttypes.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
@@ -636,6 +637,13 @@
 	LOGP(DL1IF, LOGL_DEBUG, "Paging request received: chan_needed=%d "
 		"length=%d\n", pag_req->chan_needed, pag_req->identity_lv[0]);
 
+	/* check if identity does not fit: length > sizeof(lv) - 1 */
+	if (pag_req->identity_lv[0] >= sizeof(pag_req->identity_lv)) {
+		LOGP(DL1IF, LOGL_ERROR, "Paging identity too large (%" PRIu8 ")\n",
+			pag_req->identity_lv[0]);
+		return -EINVAL;
+	}
+
 	return BTS::main_bts()->add_paging(pag_req->chan_needed,
 						pag_req->identity_lv);
 }

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-pcu/+/16527
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-pcu
Gerrit-Branch: master
Gerrit-Change-Id: I803e1d2577a0d210e74feb5ca4c216375a5024ea
Gerrit-Change-Number: 16527
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin at sysmocom.de>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20191209/8f46baa6/attachment.htm>