Attention is currently required from: laforge, osmith, pespin.
pespin uploaded patch set #2 to this change.
The following approvals got outdated and were removed: Code-Review+1 by osmith, Code-Review+2 by laforge, Verified+1 by Jenkins Builder
The change is no longer submittable: Code-Review and Verified are unsatisfied now.
gsm: Reject BSSMAP Encryption Information IE with key length != 8
From early TS 08.08 to current 3GPP TS 48.008 release 19,
3.2.2.10 Encryption Information IE clearly states that
the key size should be 8 if present.
This also in turn fixes a potential write buffer overflow if an IE with
len>253 was passed to the decoding function.
This patch fixes the problem by rewriting the function, since it
actually was way too convoluted/complex for the kind of checks it had to
do. This way also a call to memcpy is avoided if no key is present.
Related: OS#7054
Reported-By: Adam Bedard <adam.bedard@gmail.com>
Change-Id: I9fd70875f35cebb923278869e1260c5bf3047439
---
M src/gsm/gsm0808_utils.c
M tests/gsm0808/gsm0808_test.c
2 files changed, 38 insertions(+), 7 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/51/43251/2
To view, visit change 43251. To unsubscribe, or for help writing mail filters, visit settings.