Skip to content
Sign in

Changes

Started by upstream project gerrit-osmo-bts #1118
Started 15 hr ago
Queued 34 min
Took 3 min 35 sec on built-in
l1sap: check_for_ciph_cmd(): add missing msgb length check

The function accesses msg->data[0..4] without first verifying that the
message is at least 5 bytes long, which would cause a buffer over-read
on a malformed (too short) LAPDm frame.

Change-Id: I47690f1a6357e42913bfa8100e36c05cb4f0607a
src/common/l1sap.c
Vadim Yanitskiy at