fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email )
Change subject: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers ...................................................................... gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers ipa_ccm_id_get_parse() and ipa_ccm_id_resp_parse() only checked t_len against the remaining buffer length, so a zero-length tag (t_len == 0) passed the check. The subsequent "t_len - 1" then underflowed: dec->lv[t_tag].len (a uint16_t) became 65535, and cur/len were adjusted in the wrong direction, letting the loop walk past the buffer on the next iteration. Reject t_len < 1 up front, mirroring the equivalent guard already present in ipa_ccm_idtag_parse_off(). Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3 Reported-By: Adam Bedard <[email protected]> Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/31/43231/1 diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index d554faf..50fa31f 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -174,6 +174,12 @@ t_len = *cur++; t_tag = *cur++; + if (t_len < 1) { + LOGPC(DLMI, LOGL_DEBUG, "\n"); + LOGP(DLMI, LOGL_ERROR, "The tag length is too short: %d < 1\n", t_len); + return -EINVAL; + } + if (t_len > len + 1) { LOGPC(DLMI, LOGL_DEBUG, "\n"); LOGP(DLMI, LOGL_ERROR, "The tag does not fit: %d > %d\n", t_len, len + 1); @@ -216,6 +222,12 @@ cur += 2; t_tag = *cur++; + if (t_len < 1) { + LOGPC(DLMI, LOGL_DEBUG, "\n"); + LOGP(DLMI, LOGL_ERROR, "The tag length is too short: %d < 1\n", t_len); + return -EINVAL; + } + if (t_len > len + 1) { LOGPC(DLMI, LOGL_DEBUG, "\n"); LOGP(DLMI, LOGL_ERROR, "The tag does not fit: %d > %d\n", t_len, len + 1); -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3 Gerrit-Change-Number: 43231 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <[email protected]>
