From 3b644a75c9530b8fc60e2fa964dfb2ae327e240d Mon Sep 17 00:00:00 2001 From: Peter Wu Date: Sat, 20 Feb 2016 16:02:54 +0100 Subject: Fix various off-by-one in buffer sizes Some only allow buffer overruns (read), others also buffer overflows (write). Found by looking for '\[ *N *\]' where N is 255, 0xff, 15 and 0xf (case insensitive). Change-Id: I250687e2fdeb8fbd5eaf0bbb8251c3dab9640760 Reviewed-on: https://code.wireshark.org/review/14034 Reviewed-by: Peter Wu --- ui/cli/tap-gsm_astat.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'ui/cli') diff --git a/ui/cli/tap-gsm_astat.c b/ui/cli/tap-gsm_astat.c index 4454f12863..8b5bb2b5ab 100644 --- a/ui/cli/tap-gsm_astat.c +++ b/ui/cli/tap-gsm_astat.c @@ -44,16 +44,16 @@ void register_tap_listener_gsm_astat(void); typedef struct _gsm_a_stat_t { - int bssmap_message_type[0xff]; - int dtap_mm_message_type[0xff]; - int dtap_rr_message_type[0xff]; - int dtap_cc_message_type[0xff]; - int dtap_gmm_message_type[0xff]; - int dtap_sms_message_type[0xff]; - int dtap_sm_message_type[0xff]; - int dtap_ss_message_type[0xff]; - int dtap_tp_message_type[0xff]; - int sacch_rr_message_type[0xff]; + int bssmap_message_type[0x100]; + int dtap_mm_message_type[0x100]; + int dtap_rr_message_type[0x100]; + int dtap_cc_message_type[0x100]; + int dtap_gmm_message_type[0x100]; + int dtap_sms_message_type[0x100]; + int dtap_sm_message_type[0x100]; + int dtap_ss_message_type[0x100]; + int dtap_tp_message_type[0x100]; + int sacch_rr_message_type[0x100]; } gsm_a_stat_t; -- cgit v1.2.1