commit 7689e0f1a20e58568e9133c3ef03ca113b9099dd
author Vadim Yanitskiy <axilirator@gmail.com> Wed Jan 17 03:23:39 2018 +0600
committer Harald Welte <laforge@gnumonks.org> Wed Jan 17 10:45:40 2018 +0000
tree cd1c26eafbcd2bf5e6293bf3c5ad6a63e81aced2
parent 44ebb939eb2812d7452c77eed7a8d73b1bbfe03b

gsm0480: pass exact GSM 04.80 payload length to parse_ss()

Change-Id: I9608d4ad16d7581320615c140beaac36628c31a4

src/gsm/gsm0480.c

diff --git a/src/gsm/gsm0480.c b/src/gsm/gsm0480.c
index 8319b19..75388b9 100644
--- a/src/gsm/gsm0480.c
+++ b/src/gsm/gsm0480.c
@@ -232,7 +232,7 @@
 		req->transaction_id = hdr->proto_discr & 0x70;
 
 		ss.transaction_id = req->transaction_id;
-		rc = parse_ss(hdr, len, &ss);
+		rc = parse_ss(hdr, len - sizeof(*hdr), &ss);
 
 		/* convert from ss_request to legacy ussd_request */
 		req->transaction_id = ss.transaction_id;
@@ -271,7 +271,7 @@
 
 	if (gsm48_hdr_pdisc(hdr) == GSM48_PDISC_NC_SS) {
 		req->transaction_id = hdr->proto_discr & 0x70;
-		rc = parse_ss(hdr, len, req);
+		rc = parse_ss(hdr, len - sizeof(*hdr), req);
 	}
 
 	if (!rc)
@@ -293,10 +293,10 @@
 		req->ussd_text[0] = 0xFF;
 		break;
 	case GSM0480_MTYPE_REGISTER:
-		rc &= parse_ss_info_elements(&hdr->data[0], len - sizeof(*hdr), req);
+		rc &= parse_ss_info_elements(&hdr->data[0], len, req);
 		break;
 	case GSM0480_MTYPE_FACILITY:
-		rc &= parse_ss_facility(&hdr->data[0], len - sizeof(*hdr), req);
+		rc &= parse_ss_facility(&hdr->data[0], len, req);
 		break;
 	default:
 		LOGP(0, LOGL_DEBUG, "Unknown GSM 04.80 message-type field 0x%02x\n",