Address Savannah bug #38511:

ais_context->bitlen <= sizeof(ais_context->bits)/8 is not checked

1 files changed, 4 insertions, 0 deletions

diff --git a/drivers.c b/drivers.c
index 8d6ebd0b..e6632906 100644
--- a/drivers.c
+++ b/drivers.c
@@ -1328,6 +1328,10 @@ static bool aivdm_decode(const char *buf, size_t buflen,
 		    (1 << (7 - ais_context->bitlen % 8));
 	    }
 	    ais_context->bitlen++;
+	    if (ais_context->bitlen > sizeof(ais_context->bits)) {
+		gpsd_report(LOG_INF, "overlong AIVDM payload truncated.\n");
+		return false;
+	    }
 	}
 	/*@ +shiftnegative @*/
     }