tree 8bc2188d25bf2093f2b158e15b264c39bb3cdc3b
parent 620ba9369d63c25774975ea0a903b78929e6420c
author Neels Hofmeyr <neels@hofmeyr.de> 1520900521 +0100
committer Neels Hofmeyr <neels@hofmeyr.de> 1520900944 +0100

vlr_ciph_result: fix use after free of imeisv

Define the struct vlr_ciph_result member .imeisv not as a char* but a char[] of
appropriate length, to avoid the need to point to external memory.

Thus fix a use-after-free in msc_cipher_mode_compl(), which defined the
imeisv[] buffer in a sub-scope within that function, so that the .imeisv
pointer was already invalid when fed to vlr_subscr_rx_ciph_res().

Did you notice that the commit summary rhymes?

Closes: OS#3053
Change-Id: I90cfb952a7dec6d104200872164ebadb25d0260d