From 70a0ee56f7027d2e5738f30d62669afe1d7255a0 Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Wed, 28 Feb 2018 18:13:10 +0100 Subject: pcu_sock: Discard messages that are too short The downstream code of pcu_sock.c doesn't contain any length checks, so let's discard any messages that are shorter than the primitive length. Change-Id: I35ac84d4db6d21ea61afbd1864c810bbf601d69b --- src/common/pcu_sock.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/common/pcu_sock.c b/src/common/pcu_sock.c index fa13f242..b810174f 100644 --- a/src/common/pcu_sock.c +++ b/src/common/pcu_sock.c @@ -749,6 +749,12 @@ static int pcu_sock_read(struct osmo_fd *bfd) goto close; } + if (rc < sizeof(*pcu_prim)) { + LOGP(DPCU, LOGL_ERROR, "Received %d bytes on PCU Socket, but primitive size " + "is %lu, discarding\n", rc, sizeof(*pcu_prim)); + return 0; + } + rc = pcu_rx(state->net, pcu_prim->msg_type, pcu_prim); /* as we always synchronously process the message in pcu_rx() and -- cgit v1.2.3