fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email )
Change subject: gsm/ipa: fix out-of-bounds read in TLV tag logging ......................................................................
gsm/ipa: fix out-of-bounds read in TLV tag logging
ipa_ccm_idtag_parse_off(), ipa_ccm_id_get_parse() and ipa_ccm_id_resp_parse() logged the TLV payload with an unbounded '%s' conversion over a buffer that is not guaranteed to be NUL-terminated, so strlen() could run past the end of the caller's receive buffer. Bound the conversion to the decoded value length using '%.*s'.
Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Reported-By: Adam Bedard adam.bedard@gmail.com Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 3 insertions(+), 3 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/30/43230/1
diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index 963f97d..d554faf 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -139,7 +139,7 @@ return -EINVAL; }
- LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - len_offset, cur);
dec->lv[t_tag].len = t_len - len_offset; dec->lv[t_tag].val = cur; @@ -180,7 +180,7 @@ return -EINVAL; }
- LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur);
dec->lv[t_tag].len = t_len-1; dec->lv[t_tag].val = cur; @@ -222,7 +222,7 @@ return -EINVAL; }
- DEBUGPC(DLMI, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + DEBUGPC(DLMI, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur);
dec->lv[t_tag].len = t_len-1; dec->lv[t_tag].val = cur;