constrain gsm48_generate_mid() output array bounds
The longest BCd-digit type identity is the IMEISV with 16, so there's
no point in trying to parse up to 255 decimal digits, which will do
nothing but to overflow the caller-provided output buffer.
Let's also clearly define the required minimum size of the output
buffer and add a reltead #define for it.
Change-Id: Ic8488bc7f77dc9182e372741b88f0f06100dddc9
diff --git a/src/gb/gprs_bssgp.c b/src/gb/gprs_bssgp.c
index 3b9fbf9..be7ef9f 100644
--- a/src/gb/gprs_bssgp.c
+++ b/src/gb/gprs_bssgp.c
@@ -1156,7 +1156,7 @@
/* IMSI */
if (dup->imsi && strlen(dup->imsi)) {
- uint8_t mi[10];
+ uint8_t mi[GSM48_MID_MAX_SIZE];
int imsi_len = gsm48_generate_mid_from_imsi(mi, dup->imsi);
if (imsi_len > 2)
msgb_tvlv_push(msg, BSSGP_IE_IMSI,
@@ -1205,7 +1205,7 @@
struct bssgp_normal_hdr *bgph =
(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
uint16_t drx_params = osmo_htons(pinfo->drx_params);
- uint8_t mi[10];
+ uint8_t mi[GSM48_MID_MAX_SIZE];
int imsi_len = gsm48_generate_mid_from_imsi(mi, pinfo->imsi);
struct gsm48_ra_id ra;