csn1: Properly verify CSN_BITMAP length
Change-Id: I9f7672b534f9345caff99095504749eebad25adb
diff --git a/src/csn1.c b/src/csn1.c
index 78444bb..b3817e3 100644
--- a/src/csn1.c
+++ b/src/csn1.c
@@ -424,6 +424,10 @@
if (no_of_bits > 0)
{
+ if (no_of_bits > remaining_bits_len)
+ {
+ return ProcessError(readIndex, "csnStreamDecoder", CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, pDescr);
+ }
if (no_of_bits <= 32)
{
@@ -451,7 +455,6 @@
}
remaining_bits_len -= no_of_bits;
- assert(remaining_bits_len >= 0);
bit_offset += no_of_bits;
}
/* bitmap was successfully extracted or it was empty */
@@ -876,6 +879,10 @@
if (no_of_bits > 0)
{
+ if (no_of_bits > remaining_bits_len)
+ {
+ return ProcessError(readIndex, "csnStreamDecoder", CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, pDescr);
+ }
if (no_of_bits <= 32)
{
@@ -896,7 +903,6 @@
}
remaining_bits_len -= no_of_bits;
- assert(remaining_bits_len >= 0);
bit_offset += no_of_bits;
}
/* bitmap was successfully extracted or it was empty */
@@ -1737,6 +1743,10 @@
if (no_of_bits > 0)
{
+ if (no_of_bits > remaining_bits_len)
+ {
+ return ProcessError(writeIndex, "csnStreamDecoder", CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, pDescr);
+ }
if (no_of_bits <= 32)
{
@@ -1762,7 +1772,6 @@
}
remaining_bits_len -= no_of_bits;
- assert(remaining_bits_len >= 0);
bit_offset += no_of_bits;
}
/* bitmap was successfully extracted or it was empty */
@@ -2153,6 +2162,10 @@
if (no_of_bits > 0)
{
+ if (no_of_bits > remaining_bits_len)
+ {
+ return ProcessError(writeIndex, "csnStreamDecoder", CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, pDescr);
+ }
if (no_of_bits <= 32)
{
@@ -2172,7 +2185,6 @@
}
remaining_bits_len -= no_of_bits;
- assert(remaining_bits_len >= 0);
bit_offset += no_of_bits;
}
/* bitmap was successfully extracted or it was empty */