- check return value of getNumberOfElements in MmsValue_decodeMmsData

6 years ago · 320f41fc1f
parent 23e381fa76
commit 320f41fc1f
1 changed files with 3 additions and 1 deletions
--- a/src/mms/iso_mms/server/mms_access_result.c
+++ b/src/mms/iso_mms/server/mms_access_result.c
@ -171,9 +171,11 @@ MmsValue_decodeMmsData(uint8_t* buffer, int bufPos, int bufferLength, int* endBu
    case 0xa1: /* MMS_ARRAY */
    case 0xa2: /* MMS_STRUCTURE */
    {
-
        int elementCount = getNumberOfElements(buffer, bufPos, dataLength);

+        if (elementCount < 0)
+            goto exit_with_error;
+
        if (tag == 0xa1)
            value = MmsValue_createEmptyArray(elementCount);
        else