Shannon Baseband Negative-Size Memcpy / Out-Of-Bounds Read
iSpeech
There is a negative-size memcpy (heap overflow) when decoding the body of SIP multipart messages. According to debug strings in the modem image, this functionality is implemented in IMSPL_SipFragDecode.
Source link
Gloss