From e1766f1b7dbf90785eda3e75e6d9b6109a58fa3e Mon Sep 17 00:00:00 2001 From: Pau Espin Pedrol Date: Fri, 20 Dec 2019 16:36:27 +0100 Subject: l1sap: is_fille_frame(): verify len of data compared Change-Id: Id3d1725ff36091ed5c57927caad09a8baea6f52e --- src/common/l1sap.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src') diff --git a/src/common/l1sap.c b/src/common/l1sap.c index 213099d5..b6e21faf 100644 --- a/src/common/l1sap.c +++ b/src/common/l1sap.c @@ -458,6 +458,9 @@ static const uint8_t paging_fill[GSM_MACBLOCK_LEN] = { static bool is_fill_frame(uint8_t chan_type, const uint8_t *data, unsigned int len) { + if (len != GSM_MACBLOCK_LEN) + return false; + switch (chan_type) { case GSMTAP_CHANNEL_AGCH: if (!memcmp(data, fill_frame, GSM_MACBLOCK_LEN)) -- cgit v1.2.3