laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email )
Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... m3ua: Fix potential OOB read in rx NOTIFY INFO String IE Despite RFC4666 states it can contain "any meaningful UTF-8 character string", it also states that the string can be 0 bytes, which implicitly means a string could come without null char at the end. In any case, it's good practice to guard against it, as already done in all the other libosmo-sigtran code. Related: OS#7056 Reported-By: Adam Bedard <[email protected]> Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 --- M src/m3ua.c 1 file changed, 3 insertions(+), 4 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve osmith: Looks good to me, approved diff --git a/src/m3ua.c b/src/m3ua.c index 583800b..69b4438 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -499,10 +499,9 @@ npar->presence |= NOTIFY_PAR_P_ROUTE_CTX; } - if (info_ie) { - npar->info_string = talloc_size(ctx, info_ie->len); - memcpy(npar->info_string, info_ie->dat, info_ie->len); - } else + if (info_ie) + npar->info_string = talloc_strdup(ctx, xua_msg_part_get_str(info_ie)); + else npar->info_string = NULL; return 0; -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <[email protected]> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <[email protected]> Gerrit-Reviewer: laforge <[email protected]> Gerrit-Reviewer: osmith <[email protected]>
