n0k0 has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header in ipaccess_proxy_read_msg ...................................................................... ipaccess-proxy: reject short IPA header in ipaccess_proxy_read_msg recv() of the 3-byte IPA header can return fewer than 3 bytes on a stream socket. ipaccess_proxy_read_msg() only handles ret < 0 and ret == 0, so a short read falls through: msgb_put() advances msg->tail by 'ret' while msg->l2h is set to msg->data + sizeof(*hh). The frame length is then validated against msgb_tailroom() (measured from msg->tail), so the subsequent body recv() into msg->l2h can write up to sizeof(*hh) - ret bytes past the msgb. Reject a short header, the same way handle_udp_read() already does. Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 10 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/88/43188/1 diff --git a/src/ipaccess/ipaccess-proxy.c b/src/ipaccess/ipaccess-proxy.c index 71190f6..b1c500c 100644 --- a/src/ipaccess/ipaccess-proxy.c +++ b/src/ipaccess/ipaccess-proxy.c @@ -576,6 +576,16 @@ msgb_free(msg); *error = ret; return NULL; + } else if (ret < sizeof(*hh)) { + /* A short (split) IPA header would leave msg->l2h (msg->data + + * sizeof(*hh)) ahead of msg->tail, while the frame length below is + * validated against msgb_tailroom() measured from msg->tail; the + * body recv() could then write up to sizeof(*hh) - ret bytes past + * the buffer. Reject it, like the other IPA read paths do. */ + LOGP(DLINP, LOGL_ERROR, "short read of IPA header (%d)\n", ret); + msgb_free(msg); + *error = -EIO; + return NULL; } msgb_put(msg, ret); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 1 Gerrit-Owner: n0k0 <osmocom@hacky.software>