n0k0 has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email )
Change subject: ipaccess-proxy: reject short IPA header ......................................................................
ipaccess-proxy: reject short IPA header
recv() of the 3-byte IPA header can return fewer than 3 bytes on a stream socket. ipaccess_proxy_read_msg() only handles ret < 0 and ret == 0, so a short read falls through: msgb_put() advances msg->tail by 'ret' while msg->l2h is set to msg->data + sizeof(*hh). The frame length is then validated against msgb_tailroom() (measured from msg->tail), so the subsequent body recv() into msg->l2h can write up to sizeof(*hh) - ret bytes past the msgb.
Reject a short header, the same way handle_udp_read() already does.
Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 10 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/88/43188/2