nat: Compare the DTAP L3 size with the size of the msgb - dtap header
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
index bf1417d..93fb5b5 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
@@ -635,8 +635,10 @@
return NULL;
}
- if (*len < sizeof(struct gsm48_hdr)) {
- LOGP(DNAT, LOGL_ERROR, "GSM48 header does not fit.\n");
+ if (msgb_l3len(msg) - 3 < msg->l3h[2]) {
+ LOGP(DNAT, LOGL_ERROR,
+ "GSM48 payload does not fit: %d %d\n",
+ msg->l3h[2], msgb_l3len(msg) - 3);
return NULL;
}