From f8a3959cb27dbad8bf00a3566e342c82031e085f Mon Sep 17 00:00:00 2001 From: Vadim Yanitskiy Date: Thu, 28 May 2020 18:51:11 +0700 Subject: trxcon: fix potential buffer overflow in l1ctl_proc_est_req_h1() Change-Id: I10f03ca66412a4a7094b0f4a7319411d5d5818ef --- src/host/trxcon/l1ctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/host/trxcon/l1ctl.c b/src/host/trxcon/l1ctl.c index 84e1ec6f..192cdd1d 100644 --- a/src/host/trxcon/l1ctl.c +++ b/src/host/trxcon/l1ctl.c @@ -606,6 +606,9 @@ static int l1ctl_proc_est_req_h1(struct trx_instance *trx, struct l1ctl_h1 *h) if (!h->n) { LOGP(DL1C, LOGL_ERROR, "No channels in mobile allocation?!?\n"); return -EINVAL; + } else if (h->n > ARRAY_SIZE(ma)) { + LOGP(DL1C, LOGL_ERROR, "More than 64 channels in mobile allocation?!?\n"); + return -EINVAL; } /* Convert from network to host byte order */ -- cgit v1.2.3