Attention is currently required from: fixeria, laforge, pespin.

Hello Jenkins Builder, laforge, pespin,

I'd like you to reexamine a change. Please visit

https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email

to look at the new patch set (#2).

The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review+1 by pespin, Verified+1 by Jenkins Builder

Change subject: gsm29205: fix out-of-bounds read in osmo_dec_gcr() ......................................................................

gsm29205: fix out-of-bounds read in osmo_dec_gcr()

The length check at the top of the function only verified that the input buffer was at least 13 bytes, which is the minimum needed for .net_len == 3. For .net_len == 4 or 5 (also valid per the length check further down), the actual minimum required length is 10 + net_len, i.e. 14 or 15 bytes. With a shorter buffer, the subsequent osmo_load16be(), elem[] access and memcpy() read past the end of the caller-supplied buffer.

elem/len are taken directly from a received BSSMAP Global Call Reference IE (gsm0808_utils.c), so this is reachable with network-supplied input.

Add a length check depending on the actual .net_len, and a test.

Change-Id: I6855d6c810c2b4274ccfd7bc861405f9b4e09343 Fixes: OS#7044 --- M src/gsm/gsm29205.c M tests/gsm29205/gsm29205_test.c M tests/gsm29205/gsm29205_test.ok 3 files changed, 35 insertions(+), 0 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/90/43190/2