Attention is currently required from: laforge, pespin.
5 comments:
Patchset:
@pespin: The things you have pointed out are not relevant for the security problem this patch addresses, so I have addressed those points in a follow up-patch after this one. (Except the open question with the length, but lets discuss this one also in a follow up patch then.)
File src/libmsc/sgs_iface.c:
Patch Set #2, Line 165: const uint8_t *mme_name_enc = TLVP_VAL_MINLEN(tp, SGSAP_IE_MME_NAME, SGS_MME_NAME_LEN);
so is the TLV value actually expected to be at least SGS_MME_NAME_LEN? Is that correct?
In recent versions 3GPP TS 29.118, section 9.4.13 only says that it is an FQDN with no further info. So the length could be the maximum length of an FQDN. However in the V13.5.0 version of that spec they explicitly state that the FQDN has an exact length of 55 bytes. Then the line would be correct, but some doubt on my side remains.
Patch Set #2, Line 173: if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > mme_name_len - 1)
"if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) >= mme_name_len)" looks a lot easier to read to me but fine :)
I like the "- 1" notation more since it tells me that the comparison is related to the handling of the \0 char.
Patch Set #2, Line 179: return 0;
I'd store TLVP_LEN(tp, SGSAP_IE_MME_NAME) in some len and add an extra mme_name[len] = '\0' here so […]
Done
Patch Set #2, Line 183: osmo_apn_to_str(mme_name, TLVP_VAL(tp, SGSAP_IE_MME_NAME), TLVP_LEN(tp, SGSAP_IE_MME_NAME));
isn't "TLVP_VAL(tp, SGSAP_IE_MME_NAME)" here just "mme_name_enc" ?
I think you are right.
To view, visit change 43229. To unsubscribe, or for help writing mail filters, visit settings.