From bf69321a29699776f24b74e71c5dc3c80ede161b Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Sat, 8 Jan 2022 20:40:24 +0100
Subject: GTP: fix some false positives (#1394)

---
 src/lib/protocols/gtp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/lib/protocols/gtp.c b/src/lib/protocols/gtp.c
index 815705675..8fd85f755 100644
--- a/src/lib/protocols/gtp.c
+++ b/src/lib/protocols/gtp.c
@@ -94,7 +94,7 @@ static void ndpi_check_gtp(struct ndpi_detection_module_struct *ndpi_struct, str
           (gtp->message_type > 0 && gtp->message_type <= 129)) || /* Loose check based on TS 29.060 7.1 */
          ((version == 2) &&
           /* payload_len is always valid, because HEADER_LEN_GTP_C_V2 == sizeof(struct gtp_header_generic) */
-          (message_len <= (payload_len - HEADER_LEN_GTP_C_V2)))) {
+          (message_len == (payload_len - HEADER_LEN_GTP_C_V2)))) {
         NDPI_LOG_INFO(ndpi_struct, "found gtp-c\n");
         ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GTP_C, NDPI_PROTOCOL_GTP);
         return;
-- 
cgit v1.2.3