[XS] Change in libosmocore[master]: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder

[laforge]

laforge has uploaded this change for review. ( 
https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email )


Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
......................................................................

gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder

cbsp_dec_write_repl() then takes the 8-bit page count straight off the
wire and uses it as the bound over an array of 16 entries, overflowing
the array on the heap.

Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
---
M src/gsm/cbsp.c
1 file changed, 3 insertions(+), 1 deletion(-)



  git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/15/43215/1

diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c
index a5e58f4..7532ca9 100644
--- a/src/gsm/cbsp.c
+++ b/src/gsm/cbsp.c
@@ -684,8 +684,10 @@
                out->u.cbs.num_bcast_req = tlvp_val16be(tp, 
CBSP_IEI_NUM_BCAST_REQ);
                out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS);
                num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES);
-               if (num_of_pages < 1)
+               if (num_of_pages < 1 || num_of_pages > ARRAY_SIZE(tp)) {
+                       osmo_cbsp_errstr = "invalid number of pages";
                        return -EINVAL;
+               }
                /* parse pages */
                for (i = 0; i < num_of_pages; i++) {
                        const uint8_t *ie = TLVP_VAL(&tp[i], 
CBSP_IEI_MSG_CONTENT);

--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email
To unsubscribe, or for help writing mail filters, visit 
https://gerrit.osmocom.org/settings?usp=email

Gerrit-MessageType: newchange
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Gerrit-Change-Number: 43215
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <lafo...@osmocom.org>