dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43968?usp=email )
Change subject: gprs_sndcp_xid: double check buffer size after writing SAPIs ......................................................................
gprs_sndcp_xid: double check buffer size after writing SAPIs
The function encode_pcomp_applicable_sapis writes the applicable SAPIs to the output buffer. For this it requires 2 bytes. After that, each encoder funtion writes the remaining information to the buffer. The check at the beginning of each encoder function is sufficient to ensure that the buffer is large enough.
However, this remains only true in case the number of bytes that encode_pcomp_applicable_sapis writes is 2. If there are changes to the spec or similar, the function might write more than 2 bytes. So let's place an additional length check to be on the secure side.
Change-Id: I059c903885e21215ad1e6b835f34db2c5f70d87a Related: OS#7095 --- M src/sgsn/gprs_sndcp_xid.c 1 file changed, 20 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/68/43968/1
diff --git a/src/sgsn/gprs_sndcp_xid.c b/src/sgsn/gprs_sndcp_xid.c index 21b6030..67deaa9 100644 --- a/src/sgsn/gprs_sndcp_xid.c +++ b/src/sgsn/gprs_sndcp_xid.c @@ -115,6 +115,10 @@ dst += rc; dst_counter += rc;
+ /* We still need to write 1 byte from here */ + if (dst_maxlen - dst_counter < 1) + return -ENOMEM; + /* Encode s01 (see also: 3GPP TS 44.065, 6.5.2.1, Table 5) */ if (params->s01 < 0 || params->s01 > 255) return -EINVAL; @@ -154,6 +158,10 @@ dst += rc; dst_counter += rc;
+ /* We still need to write 7 bytes from here */ + if (dst_maxlen - dst_counter < 7) + return -ENOMEM; + /* Encode F_MAX_PERIOD (see also: 3GPP TS 44.065, 6.5.3.1, Table 6) */ if (params->f_max_period < 1 || params->f_max_period > 65535) return -EINVAL; @@ -233,6 +241,10 @@ dst += rc; dst_counter += rc;
+ /* We still need to write 36 bytes from here */ + if (dst_maxlen - dst_counter < 36) + return -ENOMEM; + /* Encode MAX_CID (see also: 3GPP TS 44.065, 6.5.4.1, Table 10) */ if (params->max_cid < 0 || params->max_cid > 16383) return -EINVAL; @@ -290,6 +302,10 @@ dst += rc; dst_counter += rc;
+ /* We still need to write 4 bytes from here */ + if (dst_maxlen - dst_counter < 4) + return -ENOMEM; + /* Encode P0 (see also: 3GPP TS 44.065, 6.6.2.1, Table 7a) */ if (params->p0 < 0 || params->p0 > 3) return -EINVAL; @@ -343,6 +359,10 @@ dst += rc; dst_counter += rc;
+ /* We still need to write 10 bytes from here */ + if (dst_maxlen - dst_counter < 10) + return -ENOMEM; + /* Encode C0 (see also: 3GPP TS 44.065, 6.6.3.1, Table 7c) */ if (params->c0 != 0x80 && params->c0 != 0xC0) return -EINVAL;