pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43222?usp=email )

Change subject: xua: Avoid OOB read of Routing Context with len < 4 ......................................................................

xua: Avoid OOB read of Routing Context with len < 4

Change-Id: If19f210c8d6a308f99b4f06fdc06581ffdc62696 --- M src/xua_shared.c 1 file changed, 5 insertions(+), 0 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/22/43222/1

diff --git a/src/xua_shared.c b/src/xua_shared.c index 51cbbf2..53b7337 100644 --- a/src/xua_shared.c +++ b/src/xua_shared.c @@ -42,6 +42,7 @@ /* this is why we can use the M3UA constants below in a function shared between M3UA + SUA */ osmo_static_assert(M3UA_ERR_INVAL_ROUT_CTX == SUA_ERR_INVAL_ROUT_CTX, _err_rctx); osmo_static_assert(M3UA_ERR_NO_CONFGD_AS_FOR_ASP == SUA_ERR_NO_CONFGD_AS_FOR_ASP, _err_as_for_asp); +osmo_static_assert(M3UA_ERR_PARAM_FIELD_ERR == SUA_ERR_PARAM_FIELD_ERR, _err_param_field_err);

/*! Find the AS for given ASP + optional routing context IE. * if rctx_ie == NULL, we assume that this ASP is only part of a single AS; @@ -58,6 +59,10 @@ *as = NULL;

if (rctx_ie) { + if (rctx_ie->len < 4) { + LOGPASP(asp, log_ss, LOGL_ERROR, "%s(): Received Routing Context with len < 4\n", __func__); + return M3UA_ERR_PARAM_FIELD_ERR; + } /* Use routing context IE to look up the AS for which the * message was received. */ uint32_t rctx = xua_msg_part_get_u32(rctx_ie);