Attention is currently required from: laforge, osmith, pespin.
Hello Jenkins Builder, laforge, osmith,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed: Code-Review+1 by osmith, Code-Review+2 by laforge, Verified+1 by Jenkins Builder
The change is no longer submittable: Code-Review and Verified are unsatisfied now.
Change subject: gsm: Reject BSSMAP Encryption Information IE with key length != 8 ......................................................................
gsm: Reject BSSMAP Encryption Information IE with key length != 8
From early TS 08.08 to current 3GPP TS 48.008 release 19, 3.2.2.10 Encryption Information IE clearly states that the key size should be 8 if present.
This also in turn fixes a potential write buffer overflow if an IE with len>253 was passed to the decoding function.
This patch fixes the problem by rewriting the function, since it actually was way too convoluted/complex for the kind of checks it had to do. This way also a call to memcpy is avoided if no key is present.
Related: OS#7054 Reported-By: Adam Bedard adam.bedard@gmail.com Change-Id: I9fd70875f35cebb923278869e1260c5bf3047439 --- M src/gsm/gsm0808_utils.c M tests/gsm0808/gsm0808_test.c 2 files changed, 38 insertions(+), 7 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/51/43251/2