diff options
| author | Jacob Erlbeck <jerlbeck@sysmocom.de> | 2015-11-27 13:26:19 +0100 |
|---|---|---|
| committer | Holger Hans Peter Freyther <holger@moiji-mobile.com> | 2016-01-15 18:11:58 +0100 |
| commit | ff42b26520a7421a6c6c9c9cd4b88aed00453b01 (patch) | |
| tree | d14e7739ea9a3d70082fcb5b95783c56ef0b1fd9 /include/osmocom/core/msgb.h | |
| parent | 0a053ec50657ea2060a1c4b8a8e811c5027ada7d (diff) | |
msgb: Assert len >= 0 in msgb_trim
Currently msgb_trim only checks for len > data_len and returns -1
in that case, allowing the caller to fix it somehow. Using a negative
length will always lead to a corrupt msgb, but this is not being
checked.
This commit adds a check for len < 0 and a conditional call to MSGB_ABORT.
Sponsored-by: On-Waves ehf
Diffstat (limited to 'include/osmocom/core/msgb.h')
| -rw-r--r-- | include/osmocom/core/msgb.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/osmocom/core/msgb.h b/include/osmocom/core/msgb.h index 9c99cadf..b057caa0 100644 --- a/include/osmocom/core/msgb.h +++ b/include/osmocom/core/msgb.h @@ -373,6 +373,8 @@ static inline void msgb_reserve(struct msgb *msg, int len) */ static inline int msgb_trim(struct msgb *msg, int len) { + if (len < 0) + MSGB_ABORT(msg, "Negative length is not allowed\n"); if (len > msg->data_len) return -1; |