Change in osmocom-bb[master]: osmocon: fix read buffer overrun in romload_prepare_block()

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

Stefan Sperling gerrit-no-reply at lists.osmocom.org
Thu Aug 23 12:48:41 UTC 2018


Stefan Sperling has uploaded this change for review. ( https://gerrit.osmocom.org/10575


Change subject: osmocon: fix read buffer overrun in romload_prepare_block()
......................................................................

osmocon: fix read buffer overrun in romload_prepare_block()

Address sanitizer triggered when trying to chainload firmware:

==18466==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000027850 at pc 0x7f5b94cfb733 bp 0x7ffe33e1ae30 sp 0x7ffe33e1a5d8
READ of size 1014 at 0x631000027850 thread T0
    #0 0x7f5b94cfb732  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732)
    #1 0x563db4293e6e in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
    #2 0x563db4293e6e in romload_prepare_block osmocom-bb/src/host/osmocon/osmocon.c:473
    #3 0x563db429541f in handle_read_romload osmocom-bb/src/host/osmocon/osmocon.c:959
    #4 0x563db429541f in serial_read osmocom-bb/src/host/osmocon/osmocon.c:1168
    #5 0x7f5b94722c83 in osmo_fd_disp_fds libosmocore/src/select.c:217
    #6 0x7f5b94722f84 in osmo_select_main libosmocore/src/select.c:257
    #7 0x563db4293b1c in main osmocom-bb/src/host/osmocon/osmocon.c:1525
    #8 0x7f5b942b9b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x563db4293c79 in _start (prefix/sbin/osmocon+0x1c79)

0x631000027850 is located 0 bytes to the right of 77904-byte region [0x631000014800,0x631000027850)
allocated by thread T0 here:
    #0 0x7f5b94d60b50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50)
    #1 0x563db4294d65 in read_file osmocom-bb/src/host/osmocon/osmocon.c:314

Change-Id: Ie2955e11dd1af75574536774ef7ddf88ddf1fe8b
---
M src/host/osmocon/osmocon.c
1 file changed, 1 insertion(+), 1 deletion(-)



  git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/75/10575/1

diff --git a/src/host/osmocon/osmocon.c b/src/host/osmocon/osmocon.c
index 131eab7..c264556 100644
--- a/src/host/osmocon/osmocon.c
+++ b/src/host/osmocon/osmocon.c
@@ -470,7 +470,7 @@
 	remaining_bytes = dnload.data_len - 3 -
 			(dnload.block_payload_size * dnload.block_number);
 
-	memcpy(block_data, dnload.write_ptr, dnload.block_payload_size);
+	memcpy(block_data, dnload.write_ptr, OSMO_MIN(dnload.block_payload_size, remaining_bytes));
 
 	if (remaining_bytes <= dnload.block_payload_size) {
 		fill_bytes = (dnload.block_payload_size - remaining_bytes);

-- 
To view, visit https://gerrit.osmocom.org/10575
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmocom-bb
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ie2955e11dd1af75574536774ef7ddf88ddf1fe8b
Gerrit-Change-Number: 10575
Gerrit-PatchSet: 1
Gerrit-Owner: Stefan Sperling <ssperling at sysmocom.de>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20180823/5a08905c/attachment.htm>


More information about the gerrit-log mailing list