laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email )
(
3 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder ......................................................................
gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
cbsp_dec_write_repl() then takes the 8-bit page count straight off the wire and uses it as the bound over an array of 16 entries, overflowing the array on the heap.
Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737 Closes: OS#7053 --- M src/gsm/cbsp.c 1 file changed, 5 insertions(+), 2 deletions(-)
Approvals: fixeria: Looks good to me, but someone else must approve pespin: Looks good to me, approved Jenkins Builder: Verified
diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c index a5e58f4..bc8bc4f 100644 --- a/src/gsm/cbsp.c +++ b/src/gsm/cbsp.c @@ -633,6 +633,7 @@ /*********************************************************************** * Message Decoding ***********************************************************************/ +#define MAX_NUM_CBS_PAGES 16 /* max. number of pages in a given CBS message */
/* 8.1.3.1 WRITE REPLACE */ static int cbsp_dec_write_repl(struct osmo_cbsp_write_replace *out, const struct tlv_parsed *tp, @@ -684,8 +685,10 @@ out->u.cbs.num_bcast_req = tlvp_val16be(tp, CBSP_IEI_NUM_BCAST_REQ); out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS); num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES); - if (num_of_pages < 1) + if (num_of_pages < 1 || num_of_pages > MAX_NUM_CBS_PAGES) { + osmo_cbsp_errstr = "invalid number of pages"; return -EINVAL; + } /* parse pages */ for (i = 0; i < num_of_pages; i++) { const uint8_t *ie = TLVP_VAL(&tp[i], CBSP_IEI_MSG_CONTENT); @@ -1264,7 +1267,7 @@ OSMO_ASSERT(in->l1h != NULL && in->l2h != NULL); struct osmo_cbsp_decoded *out = talloc_zero(ctx, struct osmo_cbsp_decoded); const struct cbsp_header *h = msgb_l1(in); - struct tlv_parsed tp[16]; /* max. number of pages in a given CBS message */ + struct tlv_parsed tp[MAX_NUM_CBS_PAGES]; unsigned int len; int rc;