fix off-by-one error in calculating RPDU length for CP-USER-DATA IE
diff --git a/openbsc/src/gsm_04_11.c b/openbsc/src/gsm_04_11.c
index 9a5a08c..728574a 100644
--- a/openbsc/src/gsm_04_11.c
+++ b/openbsc/src/gsm_04_11.c
@@ -121,10 +121,11 @@
u_int8_t rp_msg_type, u_int8_t rp_msg_ref)
{
struct gsm411_rp_hdr *rp;
+ u_int8_t len = msg->len;
/* GSM 04.11 RP-DATA header */
rp = (struct gsm411_rp_hdr *)msgb_push(msg, sizeof(*rp));
- rp->len = msg->len;
+ rp->len = len + 2;
rp->msg_type = rp_msg_type;
rp->msg_ref = rp_msg_ref; /* FIXME: Choose randomly */