Skip to content

Changes

Started by upstream project gerrit-osmo-bsc #1733
Started 1 day 2 hr ago
Queued 6.4 sec
Took 11 min on built-in
ipaccess: fix buffer overread in ipacc_parse_supp_flags()

The loop used OSMO_MAX(e->len, 4), which iterates at least 4 times
even when the IE is shorter than 4 bytes, causing a buffer overread.
Replace with OSMO_MIN(e->len, sizeof(u32)) to cap the iteration both
at the actual IE length and at the uint32_t accumulator size.

Change-Id: I97c69a71eb650cbef1cc3652d0a2a966cfd6cf60
Vadim Yanitskiy at