[PATCH] mgcp: NUL-terminate MGCP message

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/OpenBSC@lists.osmocom.org/.

Jacob Erlbeck jerlbeck at sysmocom.de
Tue Dec 3 16:14:44 UTC 2013


The MGCP message isn't always NUL-terminated when arriving at
mgcp_handle_message(). This may lead to undefined results.

This patch ensures that the message text is NUL-terminated by
setting *msg->tail to '\0' in mgcp_handle_message().

Addresses:
<000b> mgcp_protocol.c:642 Unhandled option: 'r'/114 on 0x3
<000b> mgcp_protocol.c:593 Unhandled SDP option: '='/61 on 0x3
<000b> mgcp_protocol.c:871 Unhandled option: '.'/46 on 0x2

Sponsored-by: On-Waves ehf
---
 openbsc/src/libmgcp/mgcp_protocol.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/openbsc/src/libmgcp/mgcp_protocol.c b/openbsc/src/libmgcp/mgcp_protocol.c
index d4a23a7..3487410 100644
--- a/openbsc/src/libmgcp/mgcp_protocol.c
+++ b/openbsc/src/libmgcp/mgcp_protocol.c
@@ -261,6 +261,19 @@ struct msgb *mgcp_handle_message(struct mgcp_config *cfg, struct msgb *msg)
 	int i, code, handled = 0;
 	struct msgb *resp = NULL;
 	char *data;
+	unsigned char *tail = msg->l2h + msgb_l2len(msg); /* char after l2 data */
+
+	/* Ensure that the msg->l2h is NULL terminated. */
+	if (msgb_tailroom(msg) > 0)
+		*tail = '\0';
+	else if (msgb_l2len(msg) > 0 && (tail[-1] == '\r' || tail[-1] == '\n'))
+		tail[-1] = '\0';
+	else {
+		LOGP(DMGCP, LOGL_ERROR, "Cannot NUL terminate MGCP message: "
+		     "Length: %d, Buffer size: %d\n",
+		     msgb_l2len(msg), msg->data_len);
+		return NULL;
+	}
 
 	if (msgb_l2len(msg) < 4) {
 		LOGP(DMGCP, LOGL_ERROR, "msg too short: %d\n", msg->len);
@@ -278,7 +291,6 @@ struct msgb *mgcp_handle_message(struct mgcp_config *cfg, struct msgb *msg)
 
 	/*
 	 * Check for a duplicate message and respond.
-	 * FIXME: Verify that the msg->l3h is NULL terminated.
 	 */
 	memset(&pdata, 0, sizeof(pdata));
 	pdata.cfg = cfg;
-- 
1.7.9.5





More information about the OpenBSC mailing list