nat: Access data_ptr after we have checked the length
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
index d4798c7..9e1b425 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
@@ -1026,15 +1026,15 @@
return NULL;
}
- /* look into the phone number */
- if ((data_ptr[0] & 0x01) != 1)
- return NULL;
-
if (data_len < 3) {
LOGP(DNAT, LOGL_ERROR, "SMS-SUBMIT is too short.\n");
return NULL;
}
+ /* look into the phone number */
+ if ((data_ptr[0] & 0x01) != 1)
+ return NULL;
+
dest_len = data_ptr[2];
if (data_len < dest_len + 3 || dest_len < 2) {
LOGP(DNAT, LOGL_ERROR, "SMS-SUBMIT can not have TP-DestAddr.\n");