From b96b82f6a6ddb8eba6fc27df1d4f29f03ba30983 Mon Sep 17 00:00:00 2001
From: iamsi <me@i-am.si>
Date: Mon, 15 Mar 2021 19:44:17 +0000
Subject: [PATCH] Correct a 1 byte buffer overflow in the ambe packet handling

---
 src/cdmrmmdvmprotocol.cpp | 2 +-
 src/cdmrplusprotocol.cpp  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/cdmrmmdvmprotocol.cpp b/src/cdmrmmdvmprotocol.cpp
index ed5fb2d..36d0dbb 100644
--- a/src/cdmrmmdvmprotocol.cpp
+++ b/src/cdmrmmdvmprotocol.cpp
@@ -701,7 +701,7 @@ bool CDmrmmdvmProtocol::IsValidDvFramePacket(const CBuffer &Buffer, std::array<s
 			memcpy(dmr3ambe, dmrframe, 14);
 			dmr3ambe[13] &= 0xF0;
 			dmr3ambe[13] |= (dmrframe[19] & 0x0F);
-			memcpy(&dmr3ambe[14], &dmrframe[20], 14);
+			memcpy(&dmr3ambe[14], &dmrframe[20], 13);
 			// extract sync
 			dmrsync[0] = dmrframe[13] & 0x0F;
 			::memcpy(&dmrsync[1], &dmrframe[14], 5);
diff --git a/src/cdmrplusprotocol.cpp b/src/cdmrplusprotocol.cpp
index acb02f5..39894ee 100644
--- a/src/cdmrplusprotocol.cpp
+++ b/src/cdmrplusprotocol.cpp
@@ -473,7 +473,7 @@ bool CDmrplusProtocol::IsValidDvFramePacket(const CIp &Ip, const CBuffer &Buffer
 			memcpy(dmr3ambe, dmrframe, 14);
 			dmr3ambe[13] &= 0xF0;
 			dmr3ambe[13] |= (dmrframe[19] & 0x0F);
-			memcpy(&dmr3ambe[14], &dmrframe[20], 14);
+			memcpy(&dmr3ambe[14], &dmrframe[20], 13);
 			// extract sync
 			dmrsync[0] = dmrframe[13] & 0x0F;
 			::memcpy(&dmrsync[1], &dmrframe[14], 5);