From 3b96a7ac3f1778cd94bc04c9313359175b362843 Mon Sep 17 00:00:00 2001 From: Dong Anyuan Date: Thu, 20 Jun 2019 12:39:06 +0900 Subject: [PATCH] Fix Coverity Scan CID 60241 (Passing &eplmn to function emm_proc_attach_accept which uses it as an array. This might corrupt or misinterpret adjacent memory locations.) --- openair3/NAS/UE/EMM/SAP/emm_recv.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/openair3/NAS/UE/EMM/SAP/emm_recv.c b/openair3/NAS/UE/EMM/SAP/emm_recv.c index 2c901eb49b..9af13b9dae 100644 --- a/openair3/NAS/UE/EMM/SAP/emm_recv.c +++ b/openair3/NAS/UE/EMM/SAP/emm_recv.c @@ -211,21 +211,21 @@ int emm_recv_attach_accept(nas_user_t *user, attach_accept_msg *msg, int *emm_ca /* Get the list of equivalent PLMNs */ int n_eplmns = 0; - plmn_t eplmn; + plmn_t eplmn[1]; if (msg->presencemask & ATTACH_ACCEPT_EQUIVALENT_PLMNS_PRESENT) { n_eplmns = 1; - eplmn.MCCdigit1 = msg->equivalentplmns.mccdigit1; - eplmn.MCCdigit2 = msg->equivalentplmns.mccdigit2; - eplmn.MCCdigit3 = msg->equivalentplmns.mccdigit3; - eplmn.MNCdigit1 = msg->equivalentplmns.mncdigit1; - eplmn.MNCdigit2 = msg->equivalentplmns.mncdigit2; - eplmn.MNCdigit3 = msg->equivalentplmns.mncdigit3; + eplmn[0].MCCdigit1 = msg->equivalentplmns.mccdigit1; + eplmn[0].MCCdigit2 = msg->equivalentplmns.mccdigit2; + eplmn[0].MCCdigit3 = msg->equivalentplmns.mccdigit3; + eplmn[0].MNCdigit1 = msg->equivalentplmns.mncdigit1; + eplmn[0].MNCdigit2 = msg->equivalentplmns.mncdigit2; + eplmn[0].MNCdigit3 = msg->equivalentplmns.mncdigit3; } /* Execute attach procedure accepted by the network */ rc = emm_proc_attach_accept(user, T3412, T3402, T3423, n_tais, tai, pguti, - n_eplmns, &eplmn, + n_eplmns, eplmn, &msg->esmmessagecontainer.esmmessagecontainercontents); LOG_FUNC_RETURN (rc);