From 23ff550cc9876e91ec5c3aa7038307ee16e967de Mon Sep 17 00:00:00 2001
From: iamsi <me@i-am.si>
Date: Tue, 16 Mar 2021 20:33:21 +0000
Subject: [PATCH] Correct a 1 byte buffer overflow in the ambe packet handling
 (#5)

---
 src/cdmrmmdvmprotocol.cpp | 2 +-
 src/cdmrplusprotocol.cpp  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/cdmrmmdvmprotocol.cpp b/src/cdmrmmdvmprotocol.cpp
index ed5fb2d..36d0dbb 100644
--- a/src/cdmrmmdvmprotocol.cpp
+++ b/src/cdmrmmdvmprotocol.cpp
@@ -701,7 +701,7 @@ bool CDmrmmdvmProtocol::IsValidDvFramePacket(const CBuffer &Buffer, std::array<s
 			memcpy(dmr3ambe, dmrframe, 14);
 			dmr3ambe[13] &= 0xF0;
 			dmr3ambe[13] |= (dmrframe[19] & 0x0F);
-			memcpy(&dmr3ambe[14], &dmrframe[20], 14);
+			memcpy(&dmr3ambe[14], &dmrframe[20], 13);
 			// extract sync
 			dmrsync[0] = dmrframe[13] & 0x0F;
 			::memcpy(&dmrsync[1], &dmrframe[14], 5);
diff --git a/src/cdmrplusprotocol.cpp b/src/cdmrplusprotocol.cpp
index acb02f5..39894ee 100644
--- a/src/cdmrplusprotocol.cpp
+++ b/src/cdmrplusprotocol.cpp
@@ -473,7 +473,7 @@ bool CDmrplusProtocol::IsValidDvFramePacket(const CIp &Ip, const CBuffer &Buffer
 			memcpy(dmr3ambe, dmrframe, 14);
 			dmr3ambe[13] &= 0xF0;
 			dmr3ambe[13] |= (dmrframe[19] & 0x0F);
-			memcpy(&dmr3ambe[14], &dmrframe[20], 14);
+			memcpy(&dmr3ambe[14], &dmrframe[20], 13);
 			// extract sync
 			dmrsync[0] = dmrframe[13] & 0x0F;
 			::memcpy(&dmrsync[1], &dmrframe[14], 5);