laforge submitted this change.

View Change

gsm/ipa: fix out-of-bounds read in TLV tag logging

ipa_ccm_idtag_parse_off(), ipa_ccm_id_get_parse() and
ipa_ccm_id_resp_parse() logged the TLV payload with an unbounded '%s'
conversion over a buffer that is not guaranteed to be NUL-terminated,
so strlen() could run past the end of the caller's receive buffer.
Bound the conversion to the decoded value length using '%.*s'.

Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d
Reported-By: Adam Bedard <adam.bedard@gmail.com>
Related: OS#7050
---
M src/gsm/ipa.c
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c
index 963f97d..d554faf 100644
--- a/src/gsm/ipa.c
+++ b/src/gsm/ipa.c
@@ -139,7 +139,7 @@
 			return -EINVAL;
 		}
 
-		LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur);
+		LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - len_offset, cur);
 
 		dec->lv[t_tag].len = t_len - len_offset;
 		dec->lv[t_tag].val = cur;
@@ -180,7 +180,7 @@
 			return -EINVAL;
 		}
 
-		LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur);
+		LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur);
 
 		dec->lv[t_tag].len = t_len-1;
 		dec->lv[t_tag].val = cur;
@@ -222,7 +222,7 @@
 			return -EINVAL;
 		}
 
-		DEBUGPC(DLMI, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur);
+		DEBUGPC(DLMI, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur);
 
 		dec->lv[t_tag].len = t_len-1;
 		dec->lv[t_tag].val = cur;

To view, visit change 43230. To unsubscribe, or for help writing mail filters, visit settings.