All pastes #2034355 Raw Edit

Bugfix for AUTN bug in radio fir

public text v1 · immutable
#2034355 ·published 2010-12-30 18:06 UTC
rendered paste body
LOAD:00B60808 iei_autn_found                          ; CODE XREF: perform_gsm_3gpp_auth+22j
LOAD:00B60808                 LDR     R0, [R1,R4]     ; point R0 to IE
LOAD:00B6080A                 MOVS    R2, #0x10       ; maximum allowed length for AUTN data
LOAD:00B6080C                 LDRB    R0, [R0,#1]     ; load length of AUTN IE into R0
LOAD:00B6080E                 CMP     R0, #0x10       ; check whether AUTN IE is too large
LOAD:00B60810                 BCS     autn_len_ok     ; only branch to mempcy() if R0 < 16
LOAD:00B60812                 MOVS    R2, R0          ; it's too large, hence truncate: set R2 to 16
LOAD:00B60814
LOAD:00B60814 autn_len_ok                             ; CODE XREF: perform_gsm_3gpp_auth+50j
LOAD:00B60814                 STRB    R2, [R6]
LOAD:00B60816                 LDR     R0, =dword_1F3B5C0
LOAD:00B60818                 LDR     R1, [R0,R4]
LOAD:00B6081A                 ADDS    R1, R1, #2
LOAD:00B6081C                 ADDS    R0, R6, #1
LOAD:00B6081E                 BLX     memcpy
LOAD:00B60822                 LDR     R0, =dword_1F3B5C0
LOAD:00B60824                 LDR     R0, [R0,R4]
LOAD:00B60826                 LDRB    R1, [R0,#1]
LOAD:00B60828                 CMP     R1, #0x10
LOAD:00B6082A                 BLS     loc_B60840
LOAD:00B6082C                 MOVS    R2, #0x10
LOAD:00B6082E                 LDR     R0, =dword_FB42B4
LOAD:00B60830                 MOVS    R3, #0
LOAD:00B60832                 BLX     sub_B7950C
LOAD:00B60836                 MOVS    R0, 0x177
LOAD:00B6083A                 ADR     R1, aMmsecurity_c ; "mmsecurity.c"
LOAD:00B6083C                 BL      sub_ACF198