<p>Harald Welte has uploaded this change for <strong>review</strong>.</p><p><a href="https://gerrit.osmocom.org/13570">View Change</a></p><pre style="font-family: monospace,monospace; white-space: pre-wrap;">ggsn: Fix build_ipcp_pco() in presence of invalid IPCP content<br><br>When build_ipcp_pco() iterated over the PCO list, it didn't use<br>the "outer" pco length as an increment, but used the "inner" IPCP<br>length.<br><br>If an IPCP message with an invalid "inner" length was being processed<br>(see pcap file attached to OS#3914), the PCO iteration beyond that<br>broken IPCP would fail, possibly rendering false hits.<br><br>Let's make pco_contains_proto() return a pointer to the the pco_element,<br>so that the caller can use the outer length as an increment.<br><br>Change-Id: I8e9cffde092c8c5824abfaeecb742afcf949802c<br>Related: OS#3914<br>---<br>M ggsn/ggsn.c<br>1 file changed, 7 insertions(+), 6 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://gerrit.osmocom.org:29418/osmo-ggsn refs/changes/70/13570/1</pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/ggsn/ggsn.c b/ggsn/ggsn.c</span><br><span>index 2d1368b..eac7e16 100644</span><br><span>--- a/ggsn/ggsn.c</span><br><span>+++ b/ggsn/ggsn.c</span><br><span>@@ -471,8 +471,8 @@</span><br><span> } __attribute__((packed));</span><br><span> </span><br><span> /* determine if PCO contains given protocol */</span><br><span style="color: hsl(0, 100%, 40%);">-static const uint8_t *pco_contains_proto(const struct ul255_t *pco, size_t offset,</span><br><span style="color: hsl(0, 100%, 40%);">-                                       uint16_t prot, size_t prot_minlen)</span><br><span style="color: hsl(120, 100%, 40%);">+static const struct pco_element *pco_contains_proto(const struct ul255_t *pco, size_t offset,</span><br><span style="color: hsl(120, 100%, 40%);">+                                                uint16_t prot, size_t prot_minlen)</span><br><span> {</span><br><span>  const uint8_t *cur = pco->v + 1 /*length*/ + offset;</span><br><span> </span><br><span>@@ -480,7 +480,7 @@</span><br><span>    while (cur + sizeof(struct pco_element) <= pco->v + pco->l) {</span><br><span>               const struct pco_element *elem = (const struct pco_element *)cur;</span><br><span>            if (ntohs(elem->protocol_id) == prot && elem->length >= prot_minlen)</span><br><span style="color: hsl(0, 100%, 40%);">-                   return cur;</span><br><span style="color: hsl(120, 100%, 40%);">+                   return elem;</span><br><span>                 cur += elem->length + sizeof(struct pco_element);</span><br><span>         }</span><br><span>    return NULL;</span><br><span>@@ -515,7 +515,8 @@</span><br><span> {</span><br><span>      const struct in46_addr *dns1 = &apn->v4.cfg.dns[0];</span><br><span>   const struct in46_addr *dns2 = &apn->v4.cfg.dns[1];</span><br><span style="color: hsl(0, 100%, 40%);">-      const uint8_t *ipcp, *pco_ipcp;</span><br><span style="color: hsl(120, 100%, 40%);">+       const struct pco_element *pco_ipcp;</span><br><span style="color: hsl(120, 100%, 40%);">+   const uint8_t *ipcp;</span><br><span>         uint16_t ipcp_len;</span><br><span>   uint8_t *len1, *len2;</span><br><span>        unsigned int len_appended;</span><br><span>@@ -527,7 +528,7 @@</span><br><span>     while (pco_ipcp) {</span><br><span>           uint8_t *start = msg->tail;</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-              ipcp = (pco_ipcp + 3);  /* 2=type + 1=len */</span><br><span style="color: hsl(120, 100%, 40%);">+          ipcp = pco_ipcp->data;</span><br><span>            consumed = (ipcp - &pdp->pco_req.v[0]);</span><br><span>               remain = sizeof(pdp->pco_req.v) - consumed;</span><br><span>               ipcp_len = osmo_load16be(ipcp + 2); /* 1=code + 1=id */</span><br><span>@@ -560,7 +561,7 @@</span><br><span>                *len1 = len_appended - 3;</span><br><span>            *len2 = len_appended - 3;</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-           offset += 3 + ipcp_len;</span><br><span style="color: hsl(120, 100%, 40%);">+               offset += sizeof(pco_ipcp) + pco_ipcp->length;</span><br><span>            pco_ipcp = pco_contains_proto(&pdp->pco_req, offset, PCO_P_IPCP, sizeof(struct ipcp_hdr));</span><br><span>    }</span><br><span> </span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.osmocom.org/13570">change 13570</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.osmocom.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.osmocom.org/13570"/><meta itemprop="name" content="View Change"/></div></div>

<div style="display:none"> Gerrit-Project: osmo-ggsn </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-MessageType: newchange </div>
<div style="display:none"> Gerrit-Change-Id: I8e9cffde092c8c5824abfaeecb742afcf949802c </div>
<div style="display:none"> Gerrit-Change-Number: 13570 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Harald Welte <laforge@gnumonks.org> </div>