diff options
| author | Eric S. Raymond <esr@thyrsus.com> | 2013-10-18 10:54:05 -0400 |
|---|---|---|
| committer | Eric S. Raymond <esr@thyrsus.com> | 2013-10-18 10:54:05 -0400 |
| commit | b7fe740980dc199c65d5816d3d3eedf04da3b19f (patch) | |
| tree | 55fd961995759a4f2a2bce0c20b9c532a13ec1d6 /driver_ais.c | |
| parent | 20f1ddc9fca4345471f17c4a951971055f51d8d9 (diff) | |
| download | gpsd-b7fe740980dc199c65d5816d3d3eedf04da3b19f.tar.gz | |
Address Savannah bug #40298: AIS type 27 too strict size check
Diffstat (limited to 'driver_ais.c')
| -rw-r--r-- | driver_ais.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/driver_ais.c b/driver_ais.c index 6b5dbba6..72036915 100644 --- a/driver_ais.c +++ b/driver_ais.c @@ -1134,11 +1134,18 @@ bool ais_binary_decode(const int debug, (ais->type26.bitcount + 7) / 8); break; case 27: /* Long Range AIS Broadcast message */ - if (bitlen != 96) { + if (bitlen != 96 && bitlen != 168) { gpsd_report(debug, LOG_WARN, - "AIVDM message type 27 size not 96 bits (%zd).\n", + "unexpected AIVDM message type 27 (%zd).\n", bitlen); return false; + } if (bitlen == 168) { + /* + * This is an implementation error observed in the wild, + * sending a full 168-bit slot rather than just 96 bits. + */ + gpsd_report(debug, LOG_WARN, + "oversized 169=8-bit AIVDM message type 27.\n"); } ais->type27.accuracy = (bool)UBITS(38, 1); ais->type27.raim = UBITS(39, 1)!=0; |