Issue(#72): Fix of possible array overrun in LoRaMacChannelRemove.

Daniel Jäckle · Daniel Jäckle · commit 73b73c355429 · 2016-04-29T16:38:42.000+02:00
diff --git a/src/mac/LoRaMac.c b/src/mac/LoRaMac.c
@@ -3474,7 +3474,7 @@ LoRaMacStatus_t LoRaMacChannelRemove( uint8_t id )
         }
     }
 
-    if( id < 3 )
+    if( ( id < 3 ) || ( id >= LORA_MAX_NB_CHANNELS ) )
     {
         return LORAMAC_STATUS_PARAMETER_INVALID;
     }

Original file line number	Diff line number	Diff line change
`@@ -3474,7 +3474,7 @@ LoRaMacStatus_t LoRaMacChannelRemove( uint8_t id )`
`3474`	`3474`	`}`
`3475`	`3475`	`}`
`3476`	`3476`
`3477`		`- if( id < 3 )`
	`3477`	`+ if( ( id < 3 ) \|\| ( id >= LORA_MAX_NB_CHANNELS ) )`
`3478`	`3478`	`{`
`3479`	`3479`	`return LORAMAC_STATUS_PARAMETER_INVALID;`
`3480`	`3480`	`}`