Attention is currently required from: fixeria, n0k0, pespin.
Hello fixeria, pespin,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email
to look at the new patch set (#4).
The following approvals got outdated and were removed: Code-Review+1 by pespin, Code-Review+2 by fixeria
Change subject: ipaccess-proxy: reject oversized IPA frame length ......................................................................
ipaccess-proxy: reject oversized IPA frame length
ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the wire header and passes it straight as the recv() count into a msgb that was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever checking it against the buffer tailroom. A peer that advertises a body length larger than the remaining buffer space makes recv() write past the end of the heap allocation (heap buffer overflow).
Reject frames whose advertised length exceeds the msgb tailroom, the same way the other IPA read paths bound the read to msgb_tailroom().
Also reject a short (split) IPA header: recv() of the 3-byte header can return fewer than 3 bytes on a stream socket, which left msg->l2h ahead of msg->tail while the length was validated against msgb_tailroom() (measured from msg->tail), so a 1-2 byte body overflow was still possible. Bail out on a short header, as the other IPA read paths do.
This issue has been assigned the CVE candidate identifier CAN-2026-2051036.
Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 16 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/86/42886/4