fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email )
Change subject: gsm/ipa: fix out-of-bounds read in TLV tag logging ...................................................................... gsm/ipa: fix out-of-bounds read in TLV tag logging ipa_ccm_idtag_parse_off(), ipa_ccm_id_get_parse() and ipa_ccm_id_resp_parse() logged the TLV payload with an unbounded '%s' conversion over a buffer that is not guaranteed to be NUL-terminated, so strlen() could run past the end of the caller's receive buffer. Bound the conversion to the decoded value length using '%.*s'. Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Reported-By: Adam Bedard <[email protected]> Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 3 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/30/43230/1 diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index 963f97d..d554faf 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -139,7 +139,7 @@ return -EINVAL; } - LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - len_offset, cur); dec->lv[t_tag].len = t_len - len_offset; dec->lv[t_tag].val = cur; @@ -180,7 +180,7 @@ return -EINVAL; } - LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur); dec->lv[t_tag].len = t_len-1; dec->lv[t_tag].val = cur; @@ -222,7 +222,7 @@ return -EINVAL; } - DEBUGPC(DLMI, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + DEBUGPC(DLMI, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur); dec->lv[t_tag].len = t_len-1; dec->lv[t_tag].val = cur; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Gerrit-Change-Number: 43230 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <[email protected]>
