pespin has uploaded this change for review.
sua: sua_addr_parse_part(): Fix potential read buffer overflow
The sua_addr_parse_part() function lacked validating that the length
value in the TLV struct didn't go past the buffer, which could end up in
a read buffer overflow.
Related: OS#7079
Reported-By: Tristan Madani <tristan@talencesecurity.com>
Change-Id: I12fbdfc37bfbf6cf9ba18942eb0ec43c9d1349fe
---
M src/sua.c
1 file changed, 4 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/21/43421/1
diff --git a/src/sua.c b/src/sua.c
index 3b217f4..0784b61 100644
--- a/src/sua.c
+++ b/src/sua.c
@@ -830,9 +830,12 @@
par_tag = ntohs(par->tag);
par_len = ntohs(par->len);
- /* sanity: check par->len received on the wire, make sure the subtraction does not wrap past zero. */
+ /* L value must account for at least TL (struct xua_parameter_hdr): */
if (par_len < sizeof(*par))
goto subpar_fail;
+ /* Avoid reading past buffer: */
+ if (pos + par_len > param->len)
+ goto subpar_fail;
par_datalen = par_len - sizeof(*par);
LOGP(DLSUA, LOGL_DEBUG, "SUA IEI 0x%04x pos %hu/%hu: subpart tag 0x%04x, len %hu\n",
To view, visit change 43421. To unsubscribe, or for help writing mail filters, visit settings.