[bugzilla-daemon@xxxxxxxxxxxxx]

Pascal Quantin changed bug 8768

What	Removed	Added
CC		pascal.quantin@gmail.com

Comment # 1 on bug 8768 from Pascal Quantin

We have an out of bounds access here:

    /* Logical channels */
    channels = (txreg & 0x3) + 1;
[...]
    for(i = 0; i < channels; i++) {
        gint hf_channel[] = {hf_tetra_channel1, hf_tetra_channel2,
hf_tetra_channel3};
[...]
        proto_tree_add_uint( tetra_header_tree, hf_channel[i], tvb, offset, 4,
channel_type);

When channels==4, hf_channel[3] reads random memory.

We need to check in TETRA spec whether we should add a hf_tetra_channel4, or if
channels should not be incremented by 1.

---

      You are receiving this mail because:

• You are watching all bug changes.