tree d418289108bf83008687e8597f035b6d182af8a7
parent 96034fcced3f5a93af1a7859a5cc7062390143a0
author Harald Welte <laforge@osmocom.org> 1593854306 +0200
committer Harald Welte <laforge@osmocom.org> 1593854483 +0200

subchan_demux: Fix out-of-bounds write

We cannot blindly append two ubits to the 320-ubit sized buffer.  In the
end, we may already fill the buffer after the first ubit, causing a
buffer overflow with the second ubit.

Lets check if the buffer is full after every bit.  Avoid copy+pasting
but move the code repeated per bit to a new function.

Change-Id: I58d946265372278051e4f29301d4f201ab98c0fc
Closes: OS#4648