From e4799f56030a1dc73c9ebf0092084dfaa332398d Mon Sep 17 00:00:00 2001 From: Vadim Yanitskiy Date: Sun, 26 May 2019 00:55:20 +0700 Subject: gsm48_decode_bcd_number2(): return -EINVAL if LV has too big length Change-Id: Ie07b2e8bc2f9628904e88448b4ee63b359655123 --- src/gsm/gsm48_ie.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/gsm') diff --git a/src/gsm/gsm48_ie.c b/src/gsm/gsm48_ie.c index 311836d3..688698db 100644 --- a/src/gsm/gsm48_ie.c +++ b/src/gsm/gsm48_ie.c @@ -70,7 +70,7 @@ int gsm48_decode_bcd_number(char *output, int output_len, * * Errors checked: * - no or too little input data (-EIO), - * - IE length exceeds input data size (-EIO), + * - IE length exceeds input data size (-EINVAL), * - no or too little output buffer size (-ENOSPC), * - decoded number exceeds size of the output buffer (-ENOSPC). * @@ -90,7 +90,7 @@ int gsm48_decode_bcd_number2(char *output, size_t output_len, in_len = bcd_lv[0]; /* len + 1: the BCD length plus the length byte itself must fit in the input buffer. */ if (input_len < in_len + 1) - return -EIO; + return -EINVAL; for (i = 1 + h_len; i <= in_len; i++) { /* lower nibble */ -- cgit v1.2.3