summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVadim Yanitskiy <vyanitskiy@sysmocom.de>2020-05-28 18:51:11 +0700
committerfixeria <vyanitskiy@sysmocom.de>2020-06-10 17:04:54 +0000
commitf8a3959cb27dbad8bf00a3566e342c82031e085f (patch)
treebd62834265a3bc57b5db0f5f7b9d2fee89b18c00
parentb0b42332dfd015f1bf4728e7f065c8cd96983d8f (diff)
trxcon: fix potential buffer overflow in l1ctl_proc_est_req_h1()
-rw-r--r--src/host/trxcon/l1ctl.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/host/trxcon/l1ctl.c b/src/host/trxcon/l1ctl.c
index 84e1ec6f..192cdd1d 100644
--- a/src/host/trxcon/l1ctl.c
+++ b/src/host/trxcon/l1ctl.c
@@ -606,6 +606,9 @@ static int l1ctl_proc_est_req_h1(struct trx_instance *trx, struct l1ctl_h1 *h)
if (!h->n) {
LOGP(DL1C, LOGL_ERROR, "No channels in mobile allocation?!?\n");
return -EINVAL;
+ } else if (h->n > ARRAY_SIZE(ma)) {
+ LOGP(DL1C, LOGL_ERROR, "More than 64 channels in mobile allocation?!?\n");
+ return -EINVAL;
}
/* Convert from network to host byte order */