laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email ) Change subject: gb: fix buffer overflow in bssgp_rx_paging() ...................................................................... gb: fix buffer overflow in bssgp_rx_paging() gsm48_parse_ra() was called against a local 6-byte buffer that was first memcpy()'d from TLVP_VAL() using the IE's own TLVP_LEN(), which can exceed 6 bytes for BSSGP_IE_LOCATION_AREA (5 bytes expected) and BSSGP_IE_ROUTEING_AREA (6 bytes expected) when a peer sends a larger IE, overflowing ra[]. Drop the intermediate copy and pass the TLV pointer directly to gsm48_parse_ra(), which only reads the bytes it needs. Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Fixes: OS#7043 --- M src/gb/gprs_bssgp_bss.c 1 file changed, 2 insertions(+), 9 deletions(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve diff --git a/src/gb/gprs_bssgp_bss.c b/src/gb/gprs_bssgp_bss.c index 8230d87..dbb1e4b 100644 --- a/src/gb/gprs_bssgp_bss.c +++ b/src/gb/gprs_bssgp_bss.c @@ -479,11 +479,8 @@ struct bssgp_normal_hdr *bgph = (struct bssgp_normal_hdr *) msgb_bssgph(msg); struct tlv_parsed tp; - uint8_t ra[6]; int rc, data_len; - memset(ra, 0, sizeof(ra)); - data_len = msgb_bssgp_len(msg) - sizeof(*bgph); rc = bssgp_tlv_parse(&tp, bgph->data, data_len); if (rc < 0) @@ -519,14 +516,10 @@ pinfo->scope = BSSGP_PAGING_BSS_AREA; } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_LOCATION_AREA, 5)) { pinfo->scope = BSSGP_PAGING_LOCATION_AREA; - memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA), - TLVP_LEN(&tp, BSSGP_IE_LOCATION_AREA)); - gsm48_parse_ra(&pinfo->raid, ra); + gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA)); } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_ROUTEING_AREA, 6)) { pinfo->scope = BSSGP_PAGING_ROUTEING_AREA; - memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA), - TLVP_LEN(&tp, BSSGP_IE_ROUTEING_AREA)); - gsm48_parse_ra(&pinfo->raid, ra); + gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA)); } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_BVCI, 2)) { pinfo->scope = BSSGP_PAGING_BVCI; pinfo->bvci = tlvp_val16be(&tp, BSSGP_IE_BVCI); -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Gerrit-Change-Number: 43189 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy@sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge@osmocom.org> Gerrit-Reviewer: pespin <pespin@sysmocom.de>