fix ASN1 s1ap code by checking upper bound of buffer

7 years ago · 8daa834607
parent b24a1c8131
commit 8daa834607
1 changed files with 6 additions and 0 deletions
--- a/lib/src/asn1/liblte_s1ap.cc
+++ b/lib/src/asn1/liblte_s1ap.cc
@ -2243,6 +2243,12 @@ LIBLTE_ERROR_ENUM liblte_s1ap_pack_imsi(
  if(ie  != NULL &&
     ptr != NULL)
  {
+    // max length of IE buffer is 32, so limit
+    if (ie->n_octets > 31) {
+      printf("Length in struct exceeds buffer (%d > 31).\n", ie->n_octets);
+      return LIBLTE_ERROR_ENCODE_FAIL;
+    }
+
    // Dynamic octet string - IMSI
    // Length
    if(ie->n_octets < 128) {