n0k0 uploaded patch set #2 to this change.

View Change

ipaccess-proxy: reject short IPA header

recv() of the 3-byte IPA header can return fewer than 3 bytes on a
stream socket. ipaccess_proxy_read_msg() only handles ret < 0 and
ret == 0, so a short read falls through: msgb_put() advances msg->tail
by 'ret' while msg->l2h is set to msg->data + sizeof(*hh). The frame
length is then validated against msgb_tailroom() (measured from
msg->tail), so the subsequent body recv() into msg->l2h can write up to
sizeof(*hh) - ret bytes past the msgb.

Reject a short header, the same way handle_udp_read() already does.

Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b
---
M src/ipaccess/ipaccess-proxy.c
1 file changed, 10 insertions(+), 0 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/88/43188/2

To view, visit change 43188. To unsubscribe, or for help writing mail filters, visit settings.