laforge submitted this change.
gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers
ipa_ccm_id_get_parse() and ipa_ccm_id_resp_parse() only checked
t_len against the remaining buffer length, so a zero-length tag
(t_len == 0) passed the check. The subsequent "t_len - 1" then
underflowed: dec->lv[t_tag].len (a uint16_t) became 65535, and
cur/len were adjusted in the wrong direction, letting the loop
walk past the buffer on the next iteration.
Reject t_len < 1 up front, mirroring the equivalent guard already
present in ipa_ccm_idtag_parse_off().
Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3
Reported-By: Adam Bedard <adam.bedard@gmail.com>
Related: OS#7050
---
M src/gsm/ipa.c
1 file changed, 12 insertions(+), 0 deletions(-)
diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c
index d554faf..50fa31f 100644
--- a/src/gsm/ipa.c
+++ b/src/gsm/ipa.c
@@ -174,6 +174,12 @@
t_len = *cur++;
t_tag = *cur++;
+ if (t_len < 1) {
+ LOGPC(DLMI, LOGL_DEBUG, "\n");
+ LOGP(DLMI, LOGL_ERROR, "The tag length is too short: %d < 1\n", t_len);
+ return -EINVAL;
+ }
+
if (t_len > len + 1) {
LOGPC(DLMI, LOGL_DEBUG, "\n");
LOGP(DLMI, LOGL_ERROR, "The tag does not fit: %d > %d\n", t_len, len + 1);
@@ -216,6 +222,12 @@
cur += 2;
t_tag = *cur++;
+ if (t_len < 1) {
+ LOGPC(DLMI, LOGL_DEBUG, "\n");
+ LOGP(DLMI, LOGL_ERROR, "The tag length is too short: %d < 1\n", t_len);
+ return -EINVAL;
+ }
+
if (t_len > len + 1) {
LOGPC(DLMI, LOGL_DEBUG, "\n");
LOGP(DLMI, LOGL_ERROR, "The tag does not fit: %d > %d\n", t_len, len + 1);
To view, visit change 43231. To unsubscribe, or for help writing mail filters, visit settings.