tlv_parser: Fix various out-of-bounds accesses
The libosmocore TLV parser had a number of insufficient bounds checks
leading to reads beyond the end of the respective input buffer.
This patch
* adds proper out-of-bounds checks to all TLV types
* simplifies some of the existing checks
* introduces test cases to test all the corner cases
where either TAG, or length, or value are not fully contained
in the input buffer.
Thanks to Ilja Van Sprundel for reporting these problems.
Change-Id: I98b02c914c9e3ecf56050af846292aa6979d7508
diff --git a/src/gsm/tlv_parser.c b/src/gsm/tlv_parser.c
index 7930d64..967539e 100644
--- a/src/gsm/tlv_parser.c
+++ b/src/gsm/tlv_parser.c
@@ -232,7 +232,10 @@
const uint8_t *buf, int buf_len)
{
uint8_t tag;
- int len;
+ int len; /* number of bytes consumed by TLV entry */
+
+ if (buf_len < 1)
+ return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
tag = *buf;
*o_tag = tag;
@@ -265,56 +268,54 @@
break;
case TLV_TYPE_TLV:
tlv: /* GSM TS 04.07 11.2.4: Type 4 TLV */
- if (buf + 1 > buf + buf_len)
+ if (buf_len < 2)
return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
*o_val = buf+2;
*o_len = *(buf+1);
len = *o_len + 2;
- if (len > buf_len)
- return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
break;
case TLV_TYPE_vTvLV_GAN: /* 44.318 / 11.1.4 */
/* FIXME: variable-length TAG! */
+ if (buf_len < 2)
+ return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
if (*(buf+1) & 0x80) {
- /* like TL16Vbut without highest bit of len */
- if (2 > buf_len)
+ if (buf_len < 3)
return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
+ /* like TL16Vbut without highest bit of len */
*o_val = buf+3;
*o_len = (*(buf+1) & 0x7F) << 8 | *(buf+2);
len = *o_len + 3;
- if (len > buf_len)
- return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
} else {
/* like TLV */
goto tlv;
}
break;
case TLV_TYPE_TvLV:
+ if (buf_len < 2)
+ return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
if (*(buf+1) & 0x80) {
/* like TLV, but without highest bit of len */
- if (buf + 1 > buf + buf_len)
- return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
*o_val = buf+2;
*o_len = *(buf+1) & 0x7f;
len = *o_len + 2;
- if (len > buf_len)
- return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
break;
}
/* like TL16V, fallthrough */
case TLV_TYPE_TL16V:
- if (2 > buf_len)
+ if (buf_len < 3)
return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
*o_val = buf+3;
*o_len = *(buf+1) << 8 | *(buf+2);
len = *o_len + 3;
- if (len > buf_len)
- return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
break;
default:
return OSMO_TLVP_ERR_UNKNOWN_TLV_TYPE;
}
+ if (buf_len < len) {
+ *o_val = NULL;
+ return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
+ }
return len;
}