Browse Source

camd: Fix crash when ECM/EMMs are oversized

Georgi Chorbadzhiyski 6 years ago
parent
commit
9a8e52c6db
1 changed files with 4 additions and 0 deletions
  1. 4
    0
      camd.c

+ 4
- 0
camd.c View File

@@ -240,6 +240,10 @@ OUT:
240 240
 
241 241
 struct camd_msg *camd_msg_alloc(enum msg_type msg_type, uint16_t ca_id, uint16_t service_id, uint8_t *data, int data_len) {
242 242
 	struct camd_msg *c = calloc(1, sizeof(struct camd_msg));
243
+	if (data_len > (int)sizeof(c->data)) {
244
+		ts_LOGf("ERROR: Tried to allocate too big CAMD message: %d max: %lu\n", data_len, sizeof(c->data));
245
+		return NULL;
246
+	}
243 247
 	c->type       = msg_type;
244 248
 	c->ca_id      = ca_id;
245 249
 	c->service_id = service_id;

Loading…
Cancel
Save