Change in osmocom-bb[master]: trxcon: fix potential buffer overflow in l1ctl_proc_est_req_h1()

[fixeria]

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmocom-bb/+/18542 )


Change subject: trxcon: fix potential buffer overflow in l1ctl_proc_est_req_h1()
......................................................................

trxcon: fix potential buffer overflow in l1ctl_proc_est_req_h1()

Change-Id: I10f03ca66412a4a7094b0f4a7319411d5d5818ef
---
M src/host/trxcon/l1ctl.c
1 file changed, 3 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/42/18542/1

diff --git a/src/host/trxcon/l1ctl.c b/src/host/trxcon/l1ctl.c
index 84e1ec6..8690c26 100644
--- a/src/host/trxcon/l1ctl.c
+++ b/src/host/trxcon/l1ctl.c
@@ -606,6 +606,9 @@
 	if (!h->n) {
 		LOGP(DL1C, LOGL_ERROR, "No channels in mobile allocation?!?\n");
 		return -EINVAL;
+	} else if (h->n > 64) {
+		LOGP(DL1C, LOGL_ERROR, "More than 64 channels in mobile allocation?!?\n");
+		return -EINVAL;
 	}
 
 	/* Convert from network to host byte order */

-- 
To view, visit https://gerrit.osmocom.org/c/osmocom-bb/+/18542
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmocom-bb
Gerrit-Branch: master
Gerrit-Change-Id: I10f03ca66412a4a7094b0f4a7319411d5d5818ef
Gerrit-Change-Number: 18542
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <axilirator at gmail.com>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20200528/160da225/attachment.htm>