laforge has submitted this change. (
https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email )
(
3 is the latest approved patch-set.
No files were changed between the latest approved patch-set and the submitted
one.
)Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
......................................................................
gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
cbsp_dec_write_repl() then takes the 8-bit page count straight off the
wire and uses it as the bound over an array of 16 entries, overflowing
the array on the heap.
Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Closes: OS#7053
---
M src/gsm/cbsp.c
1 file changed, 5 insertions(+), 2 deletions(-)
Approvals:
fixeria: Looks good to me, but someone else must approve
pespin: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c
index a5e58f4..bc8bc4f 100644
--- a/src/gsm/cbsp.c
+++ b/src/gsm/cbsp.c
@@ -633,6 +633,7 @@
/***********************************************************************
* Message Decoding
***********************************************************************/
+#define MAX_NUM_CBS_PAGES 16 /* max. number of pages in a given CBS message */
/* 8.1.3.1 WRITE REPLACE */
static int cbsp_dec_write_repl(struct osmo_cbsp_write_replace *out, const
struct tlv_parsed *tp,
@@ -684,8 +685,10 @@
out->u.cbs.num_bcast_req = tlvp_val16be(tp,
CBSP_IEI_NUM_BCAST_REQ);
out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS);
num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES);
- if (num_of_pages < 1)
+ if (num_of_pages < 1 || num_of_pages > MAX_NUM_CBS_PAGES) {
+ osmo_cbsp_errstr = "invalid number of pages";
return -EINVAL;
+ }
/* parse pages */
for (i = 0; i < num_of_pages; i++) {
const uint8_t *ie = TLVP_VAL(&tp[i],
CBSP_IEI_MSG_CONTENT);
@@ -1264,7 +1267,7 @@
OSMO_ASSERT(in->l1h != NULL && in->l2h != NULL);
struct osmo_cbsp_decoded *out = talloc_zero(ctx, struct
osmo_cbsp_decoded);
const struct cbsp_header *h = msgb_l1(in);
- struct tlv_parsed tp[16]; /* max. number of pages in a given CBS
message */
+ struct tlv_parsed tp[MAX_NUM_CBS_PAGES];
unsigned int len;
int rc;
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Gerrit-Change-Number: 43215
Gerrit-PatchSet: 5
Gerrit-Owner: laforge <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
