laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43395?usp=email )
( 3 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: xua_rkm: rx DEREG REQ: Fix potential read buffer overflow ...................................................................... xua_rkm: rx DEREG REQ: Fix potential read buffer overflow The loop in the function was not taking into account cases like data being non-multiple of 4. Related: OS#7074 Reported-By: Tristan Madani <[email protected]> Change-Id: I861259b2bb57ce80167a8f2d1c1770b56dc09718 --- M src/xua_rkm.c 1 file changed, 21 insertions(+), 7 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved osmith: Looks good to me, but someone else must approve diff --git a/src/xua_rkm.c b/src/xua_rkm.c index acd548d..06469d8 100644 --- a/src/xua_rkm.c +++ b/src/xua_rkm.c @@ -462,19 +462,33 @@ /* SG: receive a De-Registration request from ASP */ static int m3ua_rx_rkm_dereg_req(struct osmo_ss7_asp *asp, struct xua_msg *xua) { - struct xua_msg_part *part = xua_msg_find_tag(xua, M3UA_IEI_ROUTE_CTX); + struct xua_msg_part *rctx_ie = xua_msg_find_tag(xua, M3UA_IEI_ROUTE_CTX); struct msgb *resp = m3ua_msgb_alloc(__func__); - uint32_t *rctx; - if (!part) - return -1; + OSMO_ASSERT(rctx_ie); - for (rctx = (uint32_t *)part->dat; (uint8_t *)rctx < part->dat + part->len; rctx++) - handle_rkey_dereg(asp, ntohl(*rctx), resp); + if (rctx_ie->len == 0) { + LOGPASP(asp, DLSS7, LOGL_ERROR, "%s(): Received Routing Context with len 0\n", __func__); + msgb_append_dereg_res(resp, M3UA_RKM_DEREG_ERR_INVAL_RCTX, 0); + goto send_resp; + } + if (rctx_ie->len & 0x03) { + LOGPASP(asp, DLSS7, LOGL_ERROR, + "%s(): Received Routing Context IE length non-multiple of 4!\n", __func__); + msgb_append_dereg_res(resp, M3UA_RKM_DEREG_ERR_INVAL_RCTX, 0); + goto send_resp; + } + + for (unsigned int i = 0; i < rctx_ie->len / sizeof(uint32_t); i++) { + uint8_t *rctx_raw = &rctx_ie->dat[i * sizeof(uint32_t)]; + uint32_t rctx = osmo_load32be(rctx_raw); + handle_rkey_dereg(asp, rctx, resp); + } + +send_resp: msgb_push_m3ua_hdr(resp, M3UA_MSGC_RKM, M3UA_RKM_DEREG_RSP); osmo_ss7_asp_send(asp, resp); - return 0; } -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43395?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I861259b2bb57ce80167a8f2d1c1770b56dc09718 Gerrit-Change-Number: 43395 Gerrit-PatchSet: 5 Gerrit-Owner: pespin <[email protected]> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <[email protected]> Gerrit-Reviewer: osmith <[email protected]>
