Attention is currently required from: fixeria, pespin.
osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email )
Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ......................................................................
Patch Set 1:
(1 comment)
File src/m3ua.c:
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216/comment/812c88e8_70cac2... : PS1, Line 503: npar->info_string = talloc_strdup(ctx, xua_msg_part_get_str(info_ie)); Reading https://talloc.samba.org/talloc/doc/html/group__talloc__string.html#gaca866b... I don't understand how this solves the problem. Wouldn't it just run strlen() on info_ie, reading past the end of the "string" if it does not have the null char?
Wouldn't it be better to reject strings without \0 at the end here, because the "info_string" name implies that it is a string and other code is likely to assume that it is zero-terminated?