pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43421?usp=email )
Change subject: sua: sua_addr_parse_part(): Fix potential read buffer overflow ......................................................................
sua: sua_addr_parse_part(): Fix potential read buffer overflow
The sua_addr_parse_part() function lacked validating that the length value in the TLV struct didn't go past the buffer, which could end up in a read buffer overflow.
Related: OS#7079 Reported-By: Tristan Madani tristan@talencesecurity.com Change-Id: I12fbdfc37bfbf6cf9ba18942eb0ec43c9d1349fe --- M src/sua.c 1 file changed, 4 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/21/43421/1
diff --git a/src/sua.c b/src/sua.c index 3b217f4..0784b61 100644 --- a/src/sua.c +++ b/src/sua.c @@ -830,9 +830,12 @@ par_tag = ntohs(par->tag); par_len = ntohs(par->len);
- /* sanity: check par->len received on the wire, make sure the subtraction does not wrap past zero. */ + /* L value must account for at least TL (struct xua_parameter_hdr): */ if (par_len < sizeof(*par)) goto subpar_fail; + /* Avoid reading past buffer: */ + if (pos + par_len > param->len) + goto subpar_fail; par_datalen = par_len - sizeof(*par);
LOGP(DLSUA, LOGL_DEBUG, "SUA IEI 0x%04x pos %hu/%hu: subpart tag 0x%04x, len %hu\n",