laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email )

Change subject: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify() ......................................................................

m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify()

In theory user should have a look at npar->presence before accessing those fields, but in case it is somewhere forgotten then best having some initialized values, specially in the route_ctx_count which could turn into buffer overflows or reading more garbage from uninitialized array members.

Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751 --- M src/m3ua.c 1 file changed, 4 insertions(+), 0 deletions(-)

Approvals: osmith: Looks good to me, but someone else must approve laforge: Looks good to me, approved Jenkins Builder: Verified

diff --git a/src/m3ua.c b/src/m3ua.c index 39402fd..f2455eb 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -484,6 +484,8 @@ if (aspid_ie) { npar->asp_id = xua_msg_part_get_u32(aspid_ie); npar->presence |= NOTIFY_PAR_P_ASP_ID; + } else { + npar->asp_id = 0; }

if (rctx_ie) { @@ -502,6 +504,8 @@ for (unsigned int i = 0; i < npar->route_ctx_count; i++) npar->route_ctx[i] = ntohl(*(uint32_t *)&rctx_ie->dat[i << 2]); npar->presence |= NOTIFY_PAR_P_ROUTE_CTX; + } else { + npar->route_ctx_count = 0; }

if (info_ie)