diff options
| author | Eric S. Raymond <esr@thyrsus.com> | 2010-01-28 00:55:12 +0000 |
|---|---|---|
| committer | Eric S. Raymond <esr@thyrsus.com> | 2010-01-28 00:55:12 +0000 |
| commit | a3a548f56a0f56620e171ec5cf73dcf0abaf88d3 (patch) | |
| tree | dd126665cfc5bbfd85b488ee9789df55c4ba4f86 /driver_aivdm.c | |
| parent | 4e02a8440b3e834404b2d090adbd1f2f0fb57b18 (diff) | |
| download | gpsd-a3a548f56a0f56620e171ec5cf73dcf0abaf88d3.tar.gz | |
Detect corrupted AIS messages of type 25. All regression tests pass.
Diffstat (limited to 'driver_aivdm.c')
| -rw-r--r-- | driver_aivdm.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/driver_aivdm.c b/driver_aivdm.c index 183fb84f..61c3210c 100644 --- a/driver_aivdm.c +++ b/driver_aivdm.c @@ -535,8 +535,18 @@ bool aivdm_decode(const char *buf, size_t buflen, gpsd_report(LOG_INF, "\n"); break; case 25: /* Binary Message, Single Slot */ + /* this check and the fikollowing one reject line noise */ + if (ais_context->bitlen < 40 || ais_context->bitlen > 168) { + gpsd_report(LOG_ERROR, "AIVDM message type 25 size not between 40 to 168 bits (%zd).\n", + ais_context->bitlen); + break; + } ais->type25.addressed = (bool)UBITS(38, 1); ais->type25.structured = (bool)UBITS(39, 1); + if (ais_context->bitlen < ( 40 + (16*ais->type25.structured) + (30*ais->type25.addressed) ) ) { + gpsd_report(LOG_ERROR, "AIVDM message type 25 too short for mode.\n"); + break; + } if (ais->type25.addressed) ais->type25.dest_mmsi = UBITS(40, 30); if (ais->type25.structured) |