pespin has submitted this change. (
https://gerrit.osmocom.org/c/libosmocore/+/43250?usp=email )
Change subject: gsm: Reject BSSMAP Encryption Information IE with no selected
algo
......................................................................
gsm: Reject BSSMAP Encryption Information IE with no selected algo
3GPP TS 48.008 3.2.2.10 Encryption Information IE clearly states that
case should not be used, so reject it.
Change-Id: I48ace0b3590c993b86f1471e5b57c3afee72217f
---
M src/gsm/gsm0808_utils.c
M tests/gsm0808/gsm0808_test.c
2 files changed, 11 insertions(+), 3 deletions(-)
Approvals:
laforge: Looks good to me, approved
osmith: Looks good to me, but someone else must approve
Jenkins Builder: Verified
diff --git a/src/gsm/gsm0808_utils.c b/src/gsm/gsm0808_utils.c
index c9f26d3..1abfbc8 100644
--- a/src/gsm/gsm0808_utils.c
+++ b/src/gsm/gsm0808_utils.c
@@ -820,7 +820,7 @@
return *tlv_len + 2;
}
-/*! Decode TS 08.08 Encryption Information IE
+/*! Decode 3GPP TS 48.008 3.2.2.10 Encryption Information IE
* \param[out] ei Caller-provided memory to store encryption information
* \param[in] elem IE value to be decoded
* \param[in] len Length of \a elem in bytes
@@ -843,6 +843,10 @@
perm_algo = *elem;
elem++;
+ /* "A permitted algorithms octet containing all bits encoded as 0 shall
not be used." */
+ if (perm_algo == 0x00)
+ return -EINVAL;
+
for (i = 0; i < ENCRY_INFO_PERM_ALGO_MAXLEN; i++) {
if (perm_algo & (1 << i)) {
ei->perm_algo[perm_algo_len] = i + 1;
diff --git a/tests/gsm0808/gsm0808_test.c b/tests/gsm0808/gsm0808_test.c
index ed99245..497de6c 100644
--- a/tests/gsm0808/gsm0808_test.c
+++ b/tests/gsm0808/gsm0808_test.c
@@ -1281,10 +1281,14 @@
rc_dec = gsm0808_dec_encrypt_info(&dec_ei, msg->data + 2, msg->len - 2);
OSMO_ASSERT(rc_dec == 9);
-
OSMO_ASSERT(memcmp(&enc_ei, &dec_ei, sizeof(enc_ei)) == 0);
-
msgb_free(msg);
+
+ /* Test decoding of malformed IE with no algo selected: */
+ uint8_t ei_enc_no_algo[] = { GSM0808_IE_ENCRYPTION_INFORMATION, 0x01,
0x00 };
+ rc_dec = gsm0808_dec_encrypt_info(&dec_ei, &ei_enc_no_algo[2],
sizeof(ei_enc_no_algo) - 2);
+ OSMO_ASSERT(rc_dec == -EINVAL);
+
}
static void test_gsm0808_dec_cell_id_list_srvcc(void)
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43250?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: I48ace0b3590c993b86f1471e5b57c3afee72217f
Gerrit-Change-Number: 43250
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: neels <[email protected]>
Gerrit-Reviewer: osmith <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
