3 is the latest approved patch-set.
No files were changed between the latest approved patch-set and the submitted one.


gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder

cbsp_dec_write_repl() then takes the 8-bit page count straight off the
wire and uses it as the bound over an array of 16 entries, overflowing
the array on the heap.

Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Closes: OS#7053
---
M src/gsm/cbsp.c
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c
index a5e58f4..bc8bc4f 100644
--- a/src/gsm/cbsp.c
+++ b/src/gsm/cbsp.c
@@ -633,6 +633,7 @@
 /***********************************************************************
  * Message Decoding
  ***********************************************************************/
+#define MAX_NUM_CBS_PAGES 16 /* max. number of pages in a given CBS message */
 
 /* 8.1.3.1 WRITE REPLACE */
 static int cbsp_dec_write_repl(struct osmo_cbsp_write_replace *out, const struct tlv_parsed *tp,
@@ -684,8 +685,10 @@
 		out->u.cbs.num_bcast_req = tlvp_val16be(tp, CBSP_IEI_NUM_BCAST_REQ);
 		out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS);
 		num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES);
-		if (num_of_pages < 1)
+		if (num_of_pages < 1 || num_of_pages > MAX_NUM_CBS_PAGES) {
+			osmo_cbsp_errstr = "invalid number of pages";
 			return -EINVAL;
+		}
 		/* parse pages */
 		for (i = 0; i < num_of_pages; i++) {
 			const uint8_t *ie = TLVP_VAL(&tp[i], CBSP_IEI_MSG_CONTENT);
@@ -1264,7 +1267,7 @@
 	OSMO_ASSERT(in->l1h != NULL && in->l2h != NULL);
 	struct osmo_cbsp_decoded *out = talloc_zero(ctx, struct osmo_cbsp_decoded);
 	const struct cbsp_header *h = msgb_l1(in);
-	struct tlv_parsed tp[16]; /* max. number of pages in a given CBS message */
+	struct tlv_parsed tp[MAX_NUM_CBS_PAGES];
 	unsigned int len;
 	int rc;
 

