pespin has uploaded this change for review. (
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email )
Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
......................................................................
m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
Despite RFC4666 states it can contain "any meaningful UTF-8 character
string", it also states that the string can be 0 bytes, which implicitly
means a string could come without null char at the end.
In any case, it's good practice to guard against it, as already done in
all the other libosmo-sigtran code.
Related: OS#7056
Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4
---
M src/m3ua.c
1 file changed, 3 insertions(+), 4 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran
refs/changes/16/43216/1
diff --git a/src/m3ua.c b/src/m3ua.c
index 583800b..69b4438 100644
--- a/src/m3ua.c
+++ b/src/m3ua.c
@@ -499,10 +499,9 @@
npar->presence |= NOTIFY_PAR_P_ROUTE_CTX;
}
- if (info_ie) {
- npar->info_string = talloc_size(ctx, info_ie->len);
- memcpy(npar->info_string, info_ie->dat, info_ie->len);
- } else
+ if (info_ie)
+ npar->info_string = talloc_strdup(ctx,
xua_msg_part_get_str(info_ie));
+ else
npar->info_string = NULL;
return 0;
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4
Gerrit-Change-Number: 43216
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <[email protected]>
