[PATCH] ip.access: Header has a 16bit length in network byte order

[Sylvain Munaut]

From: Sylvain Munaut <tnt at 246tNt.com>

This is confirmed by looking at the source of their dissector.
The length can go up to 273 bytes apparently (again, according
to the source of their dissector).

Signed-off-by: Sylvain Munaut <tnt at 246tNt.com>
---
 openbsc/include/openbsc/ipaccess.h |    3 +--
 openbsc/src/input/ipaccess.c       |   10 +++++-----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/openbsc/include/openbsc/ipaccess.h b/openbsc/include/openbsc/ipaccess.h
index eb17167..3956877 100644
--- a/openbsc/include/openbsc/ipaccess.h
+++ b/openbsc/include/openbsc/ipaccess.h
@@ -4,8 +4,7 @@
 #include "e1_input.h"
 
 struct ipaccess_head {
-	u_int8_t zero;
-	u_int8_t len;
+	u_int16_t len;	/* network byte order */
 	u_int8_t proto;
 	u_int8_t data[0];
 } __attribute__ ((packed));
diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c
index 1265982..ea44f1e 100644
--- a/openbsc/src/input/ipaccess.c
+++ b/openbsc/src/input/ipaccess.c
@@ -259,7 +259,7 @@ struct msgb *ipaccess_read_msg(struct bsc_fd *bfd, int *error)
 {
 	struct msgb *msg = msgb_alloc(TS1_ALLOC_SIZE, "Abis/IP");
 	struct ipaccess_head *hh;
-	int ret = 0;
+	int len, ret = 0;
 
 	if (!msg) {
 		*error = -ENOMEM;
@@ -284,8 +284,9 @@ struct msgb *ipaccess_read_msg(struct bsc_fd *bfd, int *error)
 
 	/* then read te length as specified in header */
 	msg->l2h = msg->data + sizeof(*hh);
-	ret = recv(bfd->fd, msg->l2h, hh->len, 0);
-	if (ret < hh->len) {
+	len = ntohs(hh->len);
+	ret = recv(bfd->fd, msg->l2h, len, 0);
+	if (ret < len) {
 		fprintf(stderr, "short read!\n");
 		msgb_free(msg);
 		*error = -EIO;
@@ -374,8 +375,7 @@ void ipaccess_prepend_header(struct msgb *msg, int proto)
 
 	/* prepend the ip.access header */
 	hh = (struct ipaccess_head *) msgb_push(msg, sizeof(*hh));
-	hh->zero = 0;
-	hh->len = msg->len - sizeof(*hh);
+	hh->len = htons(msg->len - sizeof(*hh));
 	hh->proto = proto;
 }
 
-- 
1.6.5.1