pespin has uploaded this change for review. (
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43395?usp=email )
Change subject: xua_rkm: rx DEREG REQ: Fix potential read buffer overflow
......................................................................
xua_rkm: rx DEREG REQ: Fix potential read buffer overflow
The loop in the function was not taking into account cases like data
being non-multiple of 4.
Change-Id: I861259b2bb57ce80167a8f2d1c1770b56dc09718
---
M src/xua_rkm.c
1 file changed, 21 insertions(+), 7 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran
refs/changes/95/43395/1
diff --git a/src/xua_rkm.c b/src/xua_rkm.c
index 6f2efc2..61730db 100644
--- a/src/xua_rkm.c
+++ b/src/xua_rkm.c
@@ -462,19 +462,33 @@
/* SG: receive a De-Registration request from ASP */
static int m3ua_rx_rkm_dereg_req(struct osmo_ss7_asp *asp, struct xua_msg *xua)
{
- struct xua_msg_part *part = xua_msg_find_tag(xua, M3UA_IEI_ROUTE_CTX);
+ struct xua_msg_part *rctx_ie = xua_msg_find_tag(xua,
M3UA_IEI_ROUTE_CTX);
struct msgb *resp = m3ua_msgb_alloc(__func__);
- uint32_t *rctx;
- if (!part)
- return -1;
+ OSMO_ASSERT(rctx_ie);
- for (rctx = (uint32_t *)part->dat; (uint8_t *)rctx < part->dat +
part->len; rctx++)
- handle_rkey_dereg(asp, ntohl(*rctx), resp);
+ if (rctx_ie->len == 0) {
+ LOGPASP(asp, DLSS7, LOGL_ERROR, "%s(): Received Routing Context
with len 0\n", __func__);
+ msgb_append_dereg_res(resp, M3UA_RKM_DEREG_ERR_INVAL_RCTX, 0);
+ goto send_resp;
+ }
+ if (rctx_ie->len & 0x03) {
+ LOGPASP(asp, DLSS7, LOGL_ERROR,
+ "%s(): Received Routing Context IE length non-multiple
of 4!\n", __func__);
+ msgb_append_dereg_res(resp, M3UA_RKM_DEREG_ERR_INVAL_RCTX, 0);
+ goto send_resp;
+ }
+
+ for (unsigned int i = 0; i < rctx_ie->len / sizeof(uint32_t); i++) {
+ uint8_t *rctx_raw = &rctx_ie->dat[i * sizeof(uint32_t)];
+ uint32_t rctx = osmo_load32be(rctx_raw);
+ handle_rkey_dereg(asp, rctx, resp);
+ }
+
+send_resp:
msgb_push_m3ua_hdr(resp, M3UA_MSGC_RKM, M3UA_RKM_DEREG_RSP);
osmo_ss7_asp_send(asp, resp);
-
return 0;
}
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43395?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: I861259b2bb57ce80167a8f2d1c1770b56dc09718
Gerrit-Change-Number: 43395
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <[email protected]>
