From b6766ee8aefc3c8a9320da0761c0b049d6cf4c1d Mon Sep 17 00:00:00 2001 From: Michael Cook Date: Sat, 27 Feb 2021 09:29:09 -0800 Subject: [PATCH] decode_SIB1: Was reading past the end of plmn_data Found by -fsanitize=address --- openair2/RRC/LTE/rrc_UE.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/openair2/RRC/LTE/rrc_UE.c b/openair2/RRC/LTE/rrc_UE.c index 8dbe1bf3aa..4594fa45f0 100644 --- a/openair2/RRC/LTE/rrc_UE.c +++ b/openair2/RRC/LTE/rrc_UE.c @@ -2899,16 +2899,18 @@ int decode_SIB1( const protocol_ctxt_t *const ctxt_pP, const uint8_t eNB_index, } LOG_I( RRC, "PLMN %d MCC %0*d, MNC %0*d\n", i + 1, mccdigits, mcc, mncdigits, mnc); - // search internal table for provider name - int plmn_ind = 0; - while (plmn_data[plmn_ind].mcc > 0) { + // search internal table for provider name + const size_t num_plmn_data = sizeof(plmn_data) / sizeof(plmn_data[0]); + for (size_t plmn_ind = 0;; ++plmn_ind) { + if (plmn_ind == num_plmn_data) { + LOG_E( RRC, "Did not find name from internal table for %u %u\n", mcc, mnc); + break; + } if ((plmn_data[plmn_ind].mcc == mcc) && (plmn_data[plmn_ind].mnc == mnc)) { LOG_I( RRC, "Found %s (name from internal table)\n", plmn_data[plmn_ind].oper_short ); break; } - - plmn_ind++; } } LOG_I( RRC, "TAC 0x%04x\n",