laforge submitted this change.
mtp3_rtpc: Fix potential assert getting rcxt_ie->len < 4
If an incoming message which contains an unbounded Routing Context IE,
it may be that it comes malformed and hence len is < 4. In that case,
xua_msg_part_get_u32() would have hit an ASSERT.
Fix the problem by simply passing by the whole Routing Context
(removing non-multiple of 4 potential churn at the end), since anyway we
should be sending the same whole set of Routing Contexts we received.
Related: OS#7074
Reported-By: Tristan Madani <tristan@talencesecurity.com>
Change-Id: Ia0a8dd4907d6ad786e9cc257d299a1521dd45dee
---
M src/mtp3_rtpc.c
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/mtp3_rtpc.c b/src/mtp3_rtpc.c
index 34d40e7..a1a8856 100644
--- a/src/mtp3_rtpc.c
+++ b/src/mtp3_rtpc.c
@@ -42,14 +42,14 @@
struct xua_msg *xua;
struct xua_msg_part *rctx_ie;
unsigned int num_rctx = 0;
- uint32_t rctx = 0;
+ uint32_t *rctx_raw = NULL;
uint32_t aff_pc = htonl(orig_xua->mtp.dpc);
if ((rctx_ie = xua_msg_find_tag(orig_xua, M3UA_IEI_ROUTE_CTX))) {
- rctx = xua_msg_part_get_u32(rctx_ie);
- num_rctx = 1;
+ rctx_raw = (uint32_t *) rctx_ie->dat;
+ num_rctx = rctx_ie->len / sizeof(uint32_t);
}
- xua = m3ua_encode_duna(&rctx, num_rctx, &aff_pc, 1,
+ xua = m3ua_encode_duna(rctx_raw, num_rctx, &aff_pc, 1,
"transfer prohibited (inaccessible SP)");
OSMO_ASSERT(xua);
To view, visit change 43410. To unsubscribe, or for help writing mail filters, visit settings.