laforge has submitted this change. (
https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email )
Change subject: gb: fix buffer overflow in bssgp_rx_paging()
......................................................................
gb: fix buffer overflow in bssgp_rx_paging()
gsm48_parse_ra() was called against a local 6-byte buffer that was
first memcpy()'d from TLVP_VAL() using the IE's own TLVP_LEN(), which
can exceed 6 bytes for BSSGP_IE_LOCATION_AREA (5 bytes expected) and
BSSGP_IE_ROUTEING_AREA (6 bytes expected) when a peer sends a larger
IE, overflowing ra[]. Drop the intermediate copy and pass the TLV
pointer directly to gsm48_parse_ra(), which only reads the bytes it
needs.
Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344
Fixes: OS#7043
---
M src/gb/gprs_bssgp_bss.c
1 file changed, 2 insertions(+), 9 deletions(-)
Approvals:
laforge: Looks good to me, approved
Jenkins Builder: Verified
pespin: Looks good to me, but someone else must approve
diff --git a/src/gb/gprs_bssgp_bss.c b/src/gb/gprs_bssgp_bss.c
index 8230d87..dbb1e4b 100644
--- a/src/gb/gprs_bssgp_bss.c
+++ b/src/gb/gprs_bssgp_bss.c
@@ -479,11 +479,8 @@
struct bssgp_normal_hdr *bgph =
(struct bssgp_normal_hdr *) msgb_bssgph(msg);
struct tlv_parsed tp;
- uint8_t ra[6];
int rc, data_len;
- memset(ra, 0, sizeof(ra));
-
data_len = msgb_bssgp_len(msg) - sizeof(*bgph);
rc = bssgp_tlv_parse(&tp, bgph->data, data_len);
if (rc < 0)
@@ -519,14 +516,10 @@
pinfo->scope = BSSGP_PAGING_BSS_AREA;
} else if (TLVP_PRES_LEN(&tp, BSSGP_IE_LOCATION_AREA, 5)) {
pinfo->scope = BSSGP_PAGING_LOCATION_AREA;
- memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA),
- TLVP_LEN(&tp, BSSGP_IE_LOCATION_AREA));
- gsm48_parse_ra(&pinfo->raid, ra);
+ gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp,
BSSGP_IE_LOCATION_AREA));
} else if (TLVP_PRES_LEN(&tp, BSSGP_IE_ROUTEING_AREA, 6)) {
pinfo->scope = BSSGP_PAGING_ROUTEING_AREA;
- memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA),
- TLVP_LEN(&tp, BSSGP_IE_ROUTEING_AREA));
- gsm48_parse_ra(&pinfo->raid, ra);
+ gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp,
BSSGP_IE_ROUTEING_AREA));
} else if (TLVP_PRES_LEN(&tp, BSSGP_IE_BVCI, 2)) {
pinfo->scope = BSSGP_PAGING_BVCI;
pinfo->bvci = tlvp_val16be(&tp, BSSGP_IE_BVCI);
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344
Gerrit-Change-Number: 43189
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
