fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email )
Change subject: gb: fix buffer overflow in bssgp_rx_paging() ......................................................................
gb: fix buffer overflow in bssgp_rx_paging()
gsm48_parse_ra() was called against a local 6-byte buffer that was first memcpy()'d from TLVP_VAL() using the IE's own TLVP_LEN(), which can exceed 6 bytes for BSSGP_IE_LOCATION_AREA (5 bytes expected) and BSSGP_IE_ROUTEING_AREA (6 bytes expected) when a peer sends a larger IE, overflowing ra[]. Drop the intermediate copy and pass the TLV pointer directly to gsm48_parse_ra(), which only reads the bytes it needs.
Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Fixes: OS#7043 --- M src/gb/gprs_bssgp_bss.c 1 file changed, 2 insertions(+), 9 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/89/43189/1
diff --git a/src/gb/gprs_bssgp_bss.c b/src/gb/gprs_bssgp_bss.c index 8230d87..dbb1e4b 100644 --- a/src/gb/gprs_bssgp_bss.c +++ b/src/gb/gprs_bssgp_bss.c @@ -479,11 +479,8 @@ struct bssgp_normal_hdr *bgph = (struct bssgp_normal_hdr *) msgb_bssgph(msg); struct tlv_parsed tp; - uint8_t ra[6]; int rc, data_len;
- memset(ra, 0, sizeof(ra)); - data_len = msgb_bssgp_len(msg) - sizeof(*bgph); rc = bssgp_tlv_parse(&tp, bgph->data, data_len); if (rc < 0) @@ -519,14 +516,10 @@ pinfo->scope = BSSGP_PAGING_BSS_AREA; } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_LOCATION_AREA, 5)) { pinfo->scope = BSSGP_PAGING_LOCATION_AREA; - memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA), - TLVP_LEN(&tp, BSSGP_IE_LOCATION_AREA)); - gsm48_parse_ra(&pinfo->raid, ra); + gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA)); } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_ROUTEING_AREA, 6)) { pinfo->scope = BSSGP_PAGING_ROUTEING_AREA; - memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA), - TLVP_LEN(&tp, BSSGP_IE_ROUTEING_AREA)); - gsm48_parse_ra(&pinfo->raid, ra); + gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA)); } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_BVCI, 2)) { pinfo->scope = BSSGP_PAGING_BVCI; pinfo->bvci = tlvp_val16be(&tp, BSSGP_IE_BVCI);