commit f5e275aec0c5a4c68cd62db838ba22ba7af7b664
author Pau Espin Pedrol <pespin@sysmocom.de> Thu Mar 26 19:54:29 2020 +0100
committer laforge <laforge@osmocom.org> Mon Mar 30 10:08:02 2020 +0000
tree b600da3caca67e449cc4df1392d8489d8cd54afd
parent 70a211747bf35084604edb6dce826cd178367920

csn1: verify enough bits present to decode whole CSN_UINT_ARRAY

Change-Id: I4a762a8fec4153b53e10df1ec8ba3708c1f47649

src/csn1.c

diff --git a/src/csn1.c b/src/csn1.c
index 1b3cc55..78444bb 100644
--- a/src/csn1.c
+++ b/src/csn1.c
@@ -338,7 +338,7 @@
           nCount = *pui16DATA(data, nCount);
         }
 
-        if (remaining_bits_len >= no_of_bits)
+        if (remaining_bits_len >= (no_of_bits * nCount))
         {
           remaining_bits_len -= (no_of_bits*nCount);
           if (no_of_bits <= 8)
@@ -781,7 +781,7 @@
               nCount = *pui16DATA(data, nCount);
             }
 
-            if (remaining_bits_len >= no_of_bits)
+            if (remaining_bits_len >= (no_of_bits * nCount))
             {
               remaining_bits_len -= (no_of_bits * nCount);
               if (no_of_bits <= 8)
@@ -1650,7 +1650,7 @@
           nCount = *pui16DATA(data, nCount);
         }
 
-        if (remaining_bits_len >= no_of_bits)
+        if (remaining_bits_len >= (no_of_bits * nCount))
         {
           if (no_of_bits <= 8)
           {
@@ -2067,7 +2067,7 @@
               nCount = *pui16DATA(data, nCount);
             }
 
-            if (remaining_bits_len >= no_of_bits)
+            if (remaining_bits_len >= (no_of_bits * nCount))
             {
               if (no_of_bits <= 8)
               {