dexter has uploaded this change for review.
sgs_iface: guard against over-long MME name IEs.
The function decode_mme_name decodes the MME name from the given
tlv_parsed struct a buffer referenced by mme_name. Since the maximum
length of the MME name is fixed, the length of the output buffer is
also fixed (SGS_MME_NAME_LEN bytes + 1 byte string terminator).
Unfortunately the function does not guard against over-long input.
When the SGSAP_IE_MME_NAME IE is longer than SGS_MME_NAME_LEN, then
either memcpy or osmo_apn_to_str may overflow the output buffer.
Bug reported by: adam.bedard@gmail.com
Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec
Related: OS#7058
---
M src/libmsc/sgs_iface.c
1 file changed, 4 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/29/43229/1
diff --git a/src/libmsc/sgs_iface.c b/src/libmsc/sgs_iface.c
index 178aa64..ddd96b9 100644
--- a/src/libmsc/sgs_iface.c
+++ b/src/libmsc/sgs_iface.c
@@ -168,6 +168,10 @@
if (!mme_name_enc)
return -EINVAL;
+ /* do not accept IEs which exceed SGS_MME_NAME_LEN */
+ if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > SGS_MME_NAME_LEN)
+ return -EINVAL;
+
/* some implementations use FDQN format violating TS 29.118 9.3.14 */
if (!osmo_parse_mme_domain(&gummei, (const char *) mme_name_enc)) {
memcpy(mme_name, mme_name_enc, TLVP_LEN(tp, SGSAP_IE_MME_NAME));
To view, visit change 43229. To unsubscribe, or for help writing mail filters, visit settings.