pespin has uploaded this change for review.

View Change

sccp2sua: osmo_sccp_addr_parse(): Fix read buffer overflow

The function was not validating reads passed the input buffer length.

Related: OS#7077
Reported-By: Tristan Madani <tristan@talencesecurity.com>
Change-Id: I1feabda052dc7a78b7d1d146aeb684e763923f74
---
M src/sccp2sua.c
1 file changed, 18 insertions(+), 2 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/17/43417/1

diff --git a/src/sccp2sua.c b/src/sccp2sua.c
index 80c24ab..84e06df 100644
--- a/src/sccp2sua.c
+++ b/src/sccp2sua.c
@@ -115,16 +115,20 @@
  *  \returns 0 in case of success, negative on error
  * According to Q.713/3.4 and RFC3868/3.10.2 */
 int osmo_sccp_addr_parse(struct osmo_sccp_addr *out,
-				const uint8_t *addr, unsigned int addrlen)
+			 const uint8_t *addr, unsigned int addrlen)
 {
 	struct sccp_called_party_address *sca;
 	uint8_t *cur;
+	const uint8_t *tail = addr + addrlen;
 	uint8_t encoding;
 	bool odd;
 	int rc;
 
 	memset(out, 0, sizeof(*out));
 
+	if (addrlen < sizeof(struct sccp_called_party_address))
+		return -1;
+
 	sca = (struct sccp_called_party_address *) addr;
 	cur = sca->data;
 
@@ -134,6 +138,8 @@
 		out->ri = OSMO_SCCP_RI_GT;
 
 	if (sca->point_code_indicator) {
+		if (cur + 2 > tail)
+			return -1;
 		out->presence |= OSMO_SCCP_ADDR_T_PC;
 		out->pc = (uint16_t) (cur[1] & 0x3f) << 8;
 		out->pc |= cur[0];
@@ -141,6 +147,8 @@
 	}
 
 	if (sca->ssn_indicator) {
+		if (cur + 1 > tail)
+			return -1;
 		out->presence |= OSMO_SCCP_ADDR_T_SSN;
 		out->ssn = *cur;
 		cur += 1;
@@ -151,6 +159,8 @@
 		out->gt.gti = OSMO_SCCP_GTI_NO_GT;
 		return 0;
 	case SCCP_TITLE_IND_NATURE_ONLY:
+		if (cur + 1 > tail)
+			return -1;
 		out->presence |= OSMO_SCCP_ADDR_T_GT;
 		out->gt.gti = OSMO_SCCP_GTI_NAI_ONLY;
 		out->gt.nai = *cur & 0x7f;
@@ -160,6 +170,8 @@
 			odd = false;
 		break;
 	case SCCP_TITLE_IND_TRANSLATION_ONLY:
+		if (cur + 1 > tail)
+			return -1;
 		out->presence |= OSMO_SCCP_ADDR_T_GT;
 		out->gt.gti = OSMO_SCCP_GTI_TT_ONLY;
 		out->gt.tt = *cur++;
@@ -167,6 +179,8 @@
 		LOGP(DLSUA, LOGL_ERROR, "Unsupported national GTI %u\n", sca->global_title_indicator);
 		return -EINVAL;
 	case SCCP_TITLE_IND_TRANS_NUM_ENC:
+		if (cur + 2 > tail)
+			return -1;
 		out->presence |= OSMO_SCCP_ADDR_T_GT;
 		out->gt.gti = OSMO_SCCP_GTI_TT_NPL_ENC;
 		out->gt.tt = *cur++;
@@ -185,6 +199,8 @@
 		}
 		break;
 	case SCCP_TITLE_IND_TRANS_NUM_ENC_NATURE:
+		if (cur + 3 > tail)
+			return -1;
 		out->presence |= OSMO_SCCP_ADDR_T_GT;
 		out->gt.gti = OSMO_SCCP_GTI_TT_NPL_ENC_NAI;
 		out->gt.tt = *cur++;
@@ -210,7 +226,7 @@
 		return -EINVAL;
 	}
 	rc = osmo_isup_party_parse(out->gt.digits, sizeof(out->gt.digits),
-				   cur, (addr+addrlen-cur), odd);
+				   cur, (tail - cur), odd);
 	if (rc < 0)
 		return rc;
 

To view, visit change 43417. To unsubscribe, or for help writing mail filters, visit settings.