aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPhilipp Maier <pmaier@sysmocom.de>2021-01-20 15:55:40 +0100
committerlaforge <laforge@osmocom.org>2021-01-20 16:10:18 +0000
commit2b11fa9b3e1556c0870d5cef833abe476e81aaff (patch)
tree1b361a0e05224ec25b7007a3a03fac938df39cf0
parent836c6dac65bcff554f4506379713e5fb52084219 (diff)
gprs_bssgp_rim: fix bug in dub_tlvp_header()
When the length field is written the function writes the lower and the higher half of the length at the same position, so the higher half is overwritten with the lower half, this is wrong. Change-Id: I3cce0b2796793554a421fd3ce8e749c52d22eaea Related: CID#216670 Related: SYS#5103
-rw-r--r--src/gb/gprs_bssgp_rim.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/gb/gprs_bssgp_rim.c b/src/gb/gprs_bssgp_rim.c
index 2096977e..23fb3a08 100644
--- a/src/gb/gprs_bssgp_rim.c
+++ b/src/gb/gprs_bssgp_rim.c
@@ -438,7 +438,7 @@ static uint8_t *dub_tlvp_header(uint8_t *buf, uint8_t iei, uint16_t len)
} else {
memmove(buf_ptr + 1, buf_ptr, len);
buf_ptr[1] = len >> 8;
- buf_ptr[1] = len & 0xff;
+ buf_ptr[2] = len & 0xff;
buf_ptr += TVLV_HDR_MAXLEN;
}
buf_ptr += len;