pespin has uploaded this change for review.
gsm: Reject BSSMAP Encryption Information IE with no selected algo
3GPP TS 48.008 3.2.2.10 Encryption Information IE clearly states that
case should not be used, so reject it.
Change-Id: I48ace0b3590c993b86f1471e5b57c3afee72217f
---
M src/gsm/gsm0808_utils.c
M tests/gsm0808/gsm0808_test.c
2 files changed, 11 insertions(+), 3 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/50/43250/1
diff --git a/src/gsm/gsm0808_utils.c b/src/gsm/gsm0808_utils.c
index c9f26d3..1abfbc8 100644
--- a/src/gsm/gsm0808_utils.c
+++ b/src/gsm/gsm0808_utils.c
@@ -820,7 +820,7 @@
return *tlv_len + 2;
}
-/*! Decode TS 08.08 Encryption Information IE
+/*! Decode 3GPP TS 48.008 3.2.2.10 Encryption Information IE
* \param[out] ei Caller-provided memory to store encryption information
* \param[in] elem IE value to be decoded
* \param[in] len Length of \a elem in bytes
@@ -843,6 +843,10 @@
perm_algo = *elem;
elem++;
+ /* "A permitted algorithms octet containing all bits encoded as 0 shall not be used." */
+ if (perm_algo == 0x00)
+ return -EINVAL;
+
for (i = 0; i < ENCRY_INFO_PERM_ALGO_MAXLEN; i++) {
if (perm_algo & (1 << i)) {
ei->perm_algo[perm_algo_len] = i + 1;
diff --git a/tests/gsm0808/gsm0808_test.c b/tests/gsm0808/gsm0808_test.c
index ed99245..497de6c 100644
--- a/tests/gsm0808/gsm0808_test.c
+++ b/tests/gsm0808/gsm0808_test.c
@@ -1281,10 +1281,14 @@
rc_dec = gsm0808_dec_encrypt_info(&dec_ei, msg->data + 2, msg->len - 2);
OSMO_ASSERT(rc_dec == 9);
-
OSMO_ASSERT(memcmp(&enc_ei, &dec_ei, sizeof(enc_ei)) == 0);
-
msgb_free(msg);
+
+ /* Test decoding of malformed IE with no algo selected: */
+ uint8_t ei_enc_no_algo[] = { GSM0808_IE_ENCRYPTION_INFORMATION, 0x01, 0x00 };
+ rc_dec = gsm0808_dec_encrypt_info(&dec_ei, &ei_enc_no_algo[2], sizeof(ei_enc_no_algo) - 2);
+ OSMO_ASSERT(rc_dec == -EINVAL);
+
}
static void test_gsm0808_dec_cell_id_list_srvcc(void)
To view, visit change 43250. To unsubscribe, or for help writing mail filters, visit settings.