Attention is currently required from: laforge, pespin.
dexter uploaded patch set #3 to this change.
The following approvals got outdated and were removed: Code-Review-1 by pespin, Verified+1 by Jenkins Builder
sgs_iface: guard against over-long MME name IEs.
The function decode_mme_name decodes the MME name from the given
tlv_parsed struct a buffer referenced by mme_name. Since the maximum
length of the MME name is fixed, the length of the output buffer is
also fixed (SGS_MME_NAME_LEN bytes + 1 byte string terminator).
Unfortunately the function does not guard against over-long input.
When the SGSAP_IE_MME_NAME IE is longer than SGS_MME_NAME_LEN, then
either memcpy or osmo_apn_to_str may overflow the output buffer.
Bug reported by: adam.bedard@gmail.com
Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec
Related: OS#7058
---
M src/libmsc/sgs_iface.c
1 file changed, 7 insertions(+), 2 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/29/43229/3
To view, visit change 43229. To unsubscribe, or for help writing mail filters, visit settings.