<p>Stefan Sperling <strong>merged</strong> this change.</p><p><a href="https://gerrit.osmocom.org/11861">View Change</a></p><div style="white-space:pre-wrap">Approvals:
Pau Espin Pedrol: Looks good to me, approved
Jenkins Builder: Verified
</div><pre style="font-family: monospace,monospace; white-space: pre-wrap;">replace bogus memcpy() call in ippool_newip()<br><br>When copying an address to a reused static hash table member<br>with memcpy(), this code mistakenly passed the size of a<br>pointer as the amount of bytes to be copied, rather than<br>the actual size of the address.<br><br>This means the IP pool could contain bogus IP addresses because<br>only addr->len (a uint8_t) and 3 further bytes of the address<br>were actually copied on 32 bit platforms. On 64 bit platforms,<br>a sufficient amount of bytes were copied for IPv4 to work<br>correctly, but too few bytes were copied for IPv6.<br><br>This problem was found by Coverity.<br><br>Replace the bogus memcpy() call with direct assignments to the<br>appropriate struct in64addr union members, and assert that the<br>length recorded for the address actually corresponds to the<br>length used by the address family (IP4, IPv6).<br><br>Change-Id: Ic21560f7519e776107485a8779702fb1279d065c<br>Related: CID#57921<br>---<br>M lib/ippool.c<br>1 file changed, 9 insertions(+), 1 deletion(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/lib/ippool.c b/lib/ippool.c</span><br><span>index 6ce3cda..36121ee 100644</span><br><span>--- a/lib/ippool.c</span><br><span>+++ b/lib/ippool.c</span><br><span>@@ -512,7 +512,15 @@</span><br><span> p2->next = NULL;</span><br><span> p2->prev = NULL;</span><br><span> p2->inuse = 2; /* Static address in use */</span><br><span style="color: hsl(0, 100%, 40%);">- memcpy(&p2->addr, addr, sizeof(addr));</span><br><span style="color: hsl(120, 100%, 40%);">+ /* p2->addr.len and addr->len already match (see above). */</span><br><span style="color: hsl(120, 100%, 40%);">+ if (p2->addr.len == sizeof(struct in_addr))</span><br><span style="color: hsl(120, 100%, 40%);">+ p2->addr.v4 = addr->v4;</span><br><span style="color: hsl(120, 100%, 40%);">+ else if (p2->addr.len == sizeof(struct in6_addr))</span><br><span style="color: hsl(120, 100%, 40%);">+ p2->addr.v6 = addr->v6;</span><br><span style="color: hsl(120, 100%, 40%);">+ else {</span><br><span style="color: hsl(120, 100%, 40%);">+ SYS_ERR(DIP, LOGL_ERROR, 0, "MS requested unsupported PDP context type");</span><br><span style="color: hsl(120, 100%, 40%);">+ return -GTPCAUSE_UNKNOWN_PDP;</span><br><span style="color: hsl(120, 100%, 40%);">+ }</span><br><span> *member = p2;</span><br><span> (void)ippool_hashadd(this, *member);</span><br><span> if (0)</span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.osmocom.org/11861">change 11861</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.osmocom.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.osmocom.org/11861"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: osmo-ggsn </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-MessageType: merged </div>
<div style="display:none"> Gerrit-Change-Id: Ic21560f7519e776107485a8779702fb1279d065c </div>
<div style="display:none"> Gerrit-Change-Number: 11861 </div>
<div style="display:none"> Gerrit-PatchSet: 3 </div>
<div style="display:none"> Gerrit-Owner: Stefan Sperling <ssperling@sysmocom.de> </div>
<div style="display:none"> Gerrit-Reviewer: Jenkins Builder (1000002) </div>
<div style="display:none"> Gerrit-Reviewer: Neels Hofmeyr <nhofmeyr@sysmocom.de> </div>
<div style="display:none"> Gerrit-Reviewer: Pau Espin Pedrol <pespin@sysmocom.de> </div>
<div style="display:none"> Gerrit-Reviewer: Stefan Sperling <ssperling@sysmocom.de> </div>