laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email ) Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder ...................................................................... gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder cbsp_dec_write_repl() then takes the 8-bit page count straight off the wire and uses it as the bound over an array of 16 entries, overflowing the array on the heap. Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737 --- M src/gsm/cbsp.c 1 file changed, 3 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/15/43215/1 diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c index a5e58f4..7532ca9 100644 --- a/src/gsm/cbsp.c +++ b/src/gsm/cbsp.c @@ -684,8 +684,10 @@ out->u.cbs.num_bcast_req = tlvp_val16be(tp, CBSP_IEI_NUM_BCAST_REQ); out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS); num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES); - if (num_of_pages < 1) + if (num_of_pages < 1 || num_of_pages > ARRAY_SIZE(tp)) { + osmo_cbsp_errstr = "invalid number of pages"; return -EINVAL; + } /* parse pages */ for (i = 0; i < num_of_pages; i++) { const uint8_t *ie = TLVP_VAL(&tp[i], CBSP_IEI_MSG_CONTENT); -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737 Gerrit-Change-Number: 43215 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge@osmocom.org>