fix ASN1 s1ap code by checking upper bound of buffer

master
Andre Puschmann 7 years ago
parent b24a1c8131
commit 8daa834607

@ -2243,6 +2243,12 @@ LIBLTE_ERROR_ENUM liblte_s1ap_pack_imsi(
if(ie != NULL && if(ie != NULL &&
ptr != NULL) ptr != NULL)
{ {
// max length of IE buffer is 32, so limit
if (ie->n_octets > 31) {
printf("Length in struct exceeds buffer (%d > 31).\n", ie->n_octets);
return LIBLTE_ERROR_ENCODE_FAIL;
}
// Dynamic octet string - IMSI // Dynamic octet string - IMSI
// Length // Length
if(ie->n_octets < 128) { if(ie->n_octets < 128) {

Loading…
Cancel
Save