fixeria has submitted this change. (
https://gerrit.osmocom.org/c/osmo-bts/+/42513?usp=email )
Change subject: l1sap: check_for_ciph_cmd(): add missing msgb length check
......................................................................
l1sap: check_for_ciph_cmd(): add missing msgb length check
The function accesses msg->data[0..4] without first verifying that the
message is at least 5 bytes long, which would cause a buffer over-read
on a malformed (too short) LAPDm frame.
Change-Id: I47690f1a6357e42913bfa8100e36c05cb4f0607a
---
M src/common/l1sap.c
1 file changed, 3 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, approved
laforge: Looks good to me, but someone else must approve
diff --git a/src/common/l1sap.c b/src/common/l1sap.c
index 3d0263f..e150398 100644
--- a/src/common/l1sap.c
+++ b/src/common/l1sap.c
@@ -215,6 +215,9 @@
return 0;
}
+ if (msgb_length(msg) < 5)
+ return 0;
+
/* First byte (Address Field) of LAPDm header) */
if (msg->data[0] != 0x03)
return 0;
--
To view, visit https://gerrit.osmocom.org/c/osmo-bts/+/42513?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Change-Id: I47690f1a6357e42913bfa8100e36c05cb4f0607a
Gerrit-Change-Number: 42513
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
