laforge has uploaded this change for review.
gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
cbsp_dec_write_repl() then takes the 8-bit page count straight off the
wire and uses it as the bound over an array of 16 entries, overflowing
the array on the heap.
Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
---
M src/gsm/cbsp.c
1 file changed, 3 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/15/43215/1
diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c
index a5e58f4..7532ca9 100644
--- a/src/gsm/cbsp.c
+++ b/src/gsm/cbsp.c
@@ -684,8 +684,10 @@
out->u.cbs.num_bcast_req = tlvp_val16be(tp, CBSP_IEI_NUM_BCAST_REQ);
out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS);
num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES);
- if (num_of_pages < 1)
+ if (num_of_pages < 1 || num_of_pages > ARRAY_SIZE(tp)) {
+ osmo_cbsp_errstr = "invalid number of pages";
return -EINVAL;
+ }
/* parse pages */
for (i = 0; i < num_of_pages; i++) {
const uint8_t *ie = TLVP_VAL(&tp[i], CBSP_IEI_MSG_CONTENT);
To view, visit change 43215. To unsubscribe, or for help writing mail filters, visit settings.