dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email )

Change subject: sgs_iface: guard against over-long MME name IEs. ......................................................................

sgs_iface: guard against over-long MME name IEs.

The function decode_mme_name decodes the MME name from the given tlv_parsed struct a buffer referenced by mme_name. Since the maximum length of the MME name is fixed, the length of the output buffer is also fixed (SGS_MME_NAME_LEN bytes + 1 byte string terminator).

Unfortunately the function does not guard against over-long input. When the SGSAP_IE_MME_NAME IE is longer than SGS_MME_NAME_LEN, then either memcpy or osmo_apn_to_str may overflow the output buffer.

Bug reported by: adam.bedard@gmail.com

Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Related: OS#7058 --- M src/libmsc/sgs_iface.c 1 file changed, 4 insertions(+), 0 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/29/43229/1

diff --git a/src/libmsc/sgs_iface.c b/src/libmsc/sgs_iface.c index 178aa64..ddd96b9 100644 --- a/src/libmsc/sgs_iface.c +++ b/src/libmsc/sgs_iface.c @@ -168,6 +168,10 @@ if (!mme_name_enc) return -EINVAL;

+ /* do not accept IEs which exceed SGS_MME_NAME_LEN */ + if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > SGS_MME_NAME_LEN) + return -EINVAL; + /* some implementations use FDQN format violating TS 29.118 9.3.14 */ if (!osmo_parse_mme_domain(&gummei, (const char *) mme_name_enc)) { memcpy(mme_name, mme_name_enc, TLVP_LEN(tp, SGSAP_IE_MME_NAME));