laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43410?usp=email )
Change subject: mtp3_rtpc: Fix potential assert getting rcxt_ie->len < 4 ......................................................................
mtp3_rtpc: Fix potential assert getting rcxt_ie->len < 4
If an incoming message which contains an unbounded Routing Context IE, it may be that it comes malformed and hence len is < 4. In that case, xua_msg_part_get_u32() would have hit an ASSERT.
Fix the problem by simply passing by the whole Routing Context (removing non-multiple of 4 potential churn at the end), since anyway we should be sending the same whole set of Routing Contexts we received.
Related: OS#7074 Reported-By: Tristan Madani tristan@talencesecurity.com Change-Id: Ia0a8dd4907d6ad786e9cc257d299a1521dd45dee --- M src/mtp3_rtpc.c 1 file changed, 4 insertions(+), 4 deletions(-)
Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified
diff --git a/src/mtp3_rtpc.c b/src/mtp3_rtpc.c index 34d40e7..a1a8856 100644 --- a/src/mtp3_rtpc.c +++ b/src/mtp3_rtpc.c @@ -42,14 +42,14 @@ struct xua_msg *xua; struct xua_msg_part *rctx_ie; unsigned int num_rctx = 0; - uint32_t rctx = 0; + uint32_t *rctx_raw = NULL; uint32_t aff_pc = htonl(orig_xua->mtp.dpc);
if ((rctx_ie = xua_msg_find_tag(orig_xua, M3UA_IEI_ROUTE_CTX))) { - rctx = xua_msg_part_get_u32(rctx_ie); - num_rctx = 1; + rctx_raw = (uint32_t *) rctx_ie->dat; + num_rctx = rctx_ie->len / sizeof(uint32_t); } - xua = m3ua_encode_duna(&rctx, num_rctx, &aff_pc, 1, + xua = m3ua_encode_duna(rctx_raw, num_rctx, &aff_pc, 1, "transfer prohibited (inaccessible SP)"); OSMO_ASSERT(xua);