smpp_mirror: Don't allocate msgb's for unrealistic amounts of memory
If the remote ESME would send us 0xffffffff as length field, don't try
to allocte 4GB of memory, but bail out.
Change-Id: I561f75210811826de06ea1673eca1df24faaa210
Fixes: CID#240738
diff --git a/src/utils/smpp_mirror.c b/src/utils/smpp_mirror.c
index 883c498..72d15e3 100644
--- a/src/utils/smpp_mirror.c
+++ b/src/utils/smpp_mirror.c
@@ -246,6 +246,10 @@
esme->read_idx += rc;
if (esme->read_idx >= sizeof(uint32_t)) {
esme->read_len = ntohl(len);
+ if (esme->read_len > 65535) {
+ /* unrealistic */
+ goto dead_socket;
+ }
msg = msgb_alloc(esme->read_len, "SMPP Rx");
if (!msg)
return -ENOMEM;
@@ -283,6 +287,7 @@
osmo_fd_unregister(&esme->wqueue.bfd);
close(esme->wqueue.bfd.fd);
esme->wqueue.bfd.fd = -1;
+ esme_read_state_reset(esme);
exit(2342);
return 0;