diff options
| -rw-r--r-- | src/gsm/ipa.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index e03f6153..0c7aaad6 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -328,7 +328,12 @@ struct msgb *ipa_ccm_make_id_resp_from_req(const struct ipaccess_unit *dev, ies[num_ies++] = t_tag; cur += t_len; - len -= t_len; + /* prevent any unsigned integer underflow due to somebody sending us + * messages with wrong length values */ + if (len <= t_len) + len -= t_len; + else + len = 0; } return ipa_ccm_make_id_resp(dev, ies, num_ies); } |