pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43417?usp=email )
Change subject: sccp2sua: osmo_sccp_addr_parse(): Fix read buffer overflow ...................................................................... sccp2sua: osmo_sccp_addr_parse(): Fix read buffer overflow The function was not validating reads passed the input buffer length. Related: OS#7077 Reported-By: Tristan Madani <[email protected]> Change-Id: I1feabda052dc7a78b7d1d146aeb684e763923f74 --- M src/sccp2sua.c 1 file changed, 18 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/17/43417/1 diff --git a/src/sccp2sua.c b/src/sccp2sua.c index 80c24ab..84e06df 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -115,16 +115,20 @@ * \returns 0 in case of success, negative on error * According to Q.713/3.4 and RFC3868/3.10.2 */ int osmo_sccp_addr_parse(struct osmo_sccp_addr *out, - const uint8_t *addr, unsigned int addrlen) + const uint8_t *addr, unsigned int addrlen) { struct sccp_called_party_address *sca; uint8_t *cur; + const uint8_t *tail = addr + addrlen; uint8_t encoding; bool odd; int rc; memset(out, 0, sizeof(*out)); + if (addrlen < sizeof(struct sccp_called_party_address)) + return -1; + sca = (struct sccp_called_party_address *) addr; cur = sca->data; @@ -134,6 +138,8 @@ out->ri = OSMO_SCCP_RI_GT; if (sca->point_code_indicator) { + if (cur + 2 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_PC; out->pc = (uint16_t) (cur[1] & 0x3f) << 8; out->pc |= cur[0]; @@ -141,6 +147,8 @@ } if (sca->ssn_indicator) { + if (cur + 1 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_SSN; out->ssn = *cur; cur += 1; @@ -151,6 +159,8 @@ out->gt.gti = OSMO_SCCP_GTI_NO_GT; return 0; case SCCP_TITLE_IND_NATURE_ONLY: + if (cur + 1 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_GT; out->gt.gti = OSMO_SCCP_GTI_NAI_ONLY; out->gt.nai = *cur & 0x7f; @@ -160,6 +170,8 @@ odd = false; break; case SCCP_TITLE_IND_TRANSLATION_ONLY: + if (cur + 1 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_GT; out->gt.gti = OSMO_SCCP_GTI_TT_ONLY; out->gt.tt = *cur++; @@ -167,6 +179,8 @@ LOGP(DLSUA, LOGL_ERROR, "Unsupported national GTI %u\n", sca->global_title_indicator); return -EINVAL; case SCCP_TITLE_IND_TRANS_NUM_ENC: + if (cur + 2 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_GT; out->gt.gti = OSMO_SCCP_GTI_TT_NPL_ENC; out->gt.tt = *cur++; @@ -185,6 +199,8 @@ } break; case SCCP_TITLE_IND_TRANS_NUM_ENC_NATURE: + if (cur + 3 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_GT; out->gt.gti = OSMO_SCCP_GTI_TT_NPL_ENC_NAI; out->gt.tt = *cur++; @@ -210,7 +226,7 @@ return -EINVAL; } rc = osmo_isup_party_parse(out->gt.digits, sizeof(out->gt.digits), - cur, (addr+addrlen-cur), odd); + cur, (tail - cur), odd); if (rc < 0) return rc; -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43417?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I1feabda052dc7a78b7d1d146aeb684e763923f74 Gerrit-Change-Number: 43417 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <[email protected]>
