add length check on emergency number list

master
b1u3s 2 years ago committed by Andre Puschmann
parent fefe9367d4
commit 08e02c9a5b

@ -3019,9 +3019,13 @@ LIBLTE_ERROR_ENUM liblte_mme_unpack_emergency_number_list_ie(uint8**
emerg_num_list->N_emerg_nums = 0; emerg_num_list->N_emerg_nums = 0;
while (length < sent_length) { while (length < sent_length) {
idx = emerg_num_list->N_emerg_nums; idx = emerg_num_list->N_emerg_nums;
//add length check on emergency number list
if (idx >= LIBLTE_MME_EMERGENCY_NUMBER_LIST_MAX_SIZE) {
return (err);
}
emerg_num_list->emerg_num[idx].N_emerg_num_digits = ((*ie_ptr)[length++] - 1) * 2; emerg_num_list->emerg_num[idx].N_emerg_num_digits = ((*ie_ptr)[length++] - 1) * 2;
if (emerg_num_list->emerg_num[idx].N_emerg_num_digits > LIBLTE_MME_EMERGENCY_NUMBER_MAX_NUM_DIGITS) { if (emerg_num_list->emerg_num[idx].N_emerg_num_digits > LIBLTE_MME_EMERGENCY_NUMBER_MAX_NUM_DIGITS) {
return err; return (err);
} }
emerg_num_list->emerg_num[idx].emerg_service_cat = emerg_num_list->emerg_num[idx].emerg_service_cat =

Loading…
Cancel
Save