Attention is currently required from: fixeria, n0k0.
Hello Jenkins Builder, fixeria,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email
to look at the new patch set (#4).
The following approvals got outdated and were removed:
Code-Review+1 by fixeria, Verified+1 by Jenkins Builder
Change subject: mslookup: fix size_t underflow in mDNS decode
......................................................................
mslookup: fix size_t underflow in mDNS decode
osmo_mdns_rfc_record_decode() computes the strnlen() scan bound as
'data_len - 10' where data_len is a size_t. osmo_mdns_msg_answer_decode()
loops "while (data_len)" with no minimum-length guard, so it can call
record_decode() with data_len in 1..9. 'data_len - 10' then underflows
to ~SIZE_MAX and strnlen() scans far past the receive buffer until it
finds a NUL, and data[name_len] reads further still, before the trailing
"name_len + 10 + rdlength > data_len" check ever runs.
A record must contain at least one name byte plus the 10 fixed trailing
bytes (type, class, ttl, rdlength); reject anything shorter so the
subtraction cannot underflow.
Additionally, an unterminated name still let the fixed-field loads read
one byte past the buffer: strnlen() can return its bound, making name_len
equal to data_len - 9, so osmo_load16be(data + name_len + 8) touched
data[data_len] before the trailing length check ran. Require room for the
name plus the 10 fixed trailing bytes before reading any of them.
Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8
---
M src/mslookup/mdns_rfc.c
1 file changed, 13 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-hlr refs/changes/88/42888/4
--
To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: osmo-hlr
Gerrit-Branch: master
Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8
Gerrit-Change-Number: 42888
Gerrit-PatchSet: 4
Gerrit-Owner: n0k0 <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Attention: n0k0 <[email protected]>
Gerrit-Attention: fixeria <[email protected]>
