From e383980a7e39b25e3b16904581c879fb5a5b0e30 Mon Sep 17 00:00:00 2001 From: Holger Hans Peter Freyther Date: Thu, 14 Oct 2010 21:17:30 +0200 Subject: ipaccess: Make sure the unitid is null terminated The nanoBTS is sending null terminated strings, make sure they are really null terminated. --- openbsc/src/input/ipaccess.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c index faa545830..18268f6b9 100644 --- a/openbsc/src/input/ipaccess.c +++ b/openbsc/src/input/ipaccess.c @@ -219,6 +219,8 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg, u_int8_t msg_type = *(msg->l2h); u_int16_t site_id = 0, bts_id = 0, trx_id = 0; struct gsm_bts *bts; + char *unitid; + int len; /* handle base messages */ ipaccess_rcvmsg_base(msg, bfd); @@ -234,9 +236,14 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg, if (!TLVP_PRESENT(&tlvp, IPAC_IDTAG_UNIT)) break; + len = TLVP_LEN(&tlvp, IPAC_IDTAG_UNIT); + if (len < 1) + break; + /* lookup BTS, create sign_link, ... */ - parse_unitid((char *)TLVP_VAL(&tlvp, IPAC_IDTAG_UNIT), - &site_id, &bts_id, &trx_id); + unitid = (char *) TLVP_VAL(&tlvp, IPAC_IDTAG_UNIT); + unitid[len - 1] = '\0'; + parse_unitid(unitid, &site_id, &bts_id, &trx_id); bts = find_bts_by_unitid(e1h->gsmnet, site_id, bts_id); if (!bts) { LOGP(DINP, LOGL_ERROR, "Unable to find BTS configuration for " -- cgit v1.2.3