osmocom
/
libosmocore
mirror of https://gerrit.osmocom.org/libosmocore
11
0
Fork 0
Code Issues Releases Wiki Activity

gsm_7bit_encode_n(): fix integer overflow in gsm_septets2octets() 

Using 'uint8_t' for the length argument is definitely a bad idea.
Because of this, packing more than 255 septets would not work as
expected.  Deprecate the old function and use 'size_t' instead.

Change-Id: Ib1aac538afeb0a5c76a1df472d555139a496e12e
This commit is contained in:
Vadim Yanitskiy 2021-01-30 01:31:32 +01:00 committed by fixeria
parent 44ac4f6c92
commit 943133cad8
5 changed files with 20 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/osmocom/gsm/gsm_utils.h
View File

@ -110,7 +110,10 @@ int gsm_7bit_encode_n(uint8_t *result, size_t n, const char *data, int *octets_w
int gsm_7bit_encode_n_ussd(uint8_t *result, size_t n, const char *data, int *octets_written);
/* the four functions below are helper functions and here for the unit test */
int gsm_septets2octets(uint8_t *result, const uint8_t *rdata, uint8_t septet_len, uint8_t padding);
int gsm_septets2octets(uint8_t *result, const uint8_t *rdata, uint8_t septet_len, uint8_t padding)
OSMO_DEPRECATED("This function is unable to handle more than 255 septets, "
"use gsm_septet_pack() instead.");
int gsm_septet_pack(uint8_t *result, const uint8_t *rdata, size_t septet_len, uint8_t padding);
int gsm_septet_encode(uint8_t *result, const char *data);
uint8_t gsm_get_octet_len(const uint8_t sept_len);
int gsm_7bit_decode_n_hdr(char *decoded, size_t n, const uint8_t *user_data, uint8_t length, uint8_t ud_hdr_ind);

10
src/gsm/gsm_utils.c
View File

@ -324,7 +324,7 @@ int gsm_septet_encode(uint8_t *result, const char *data)
* \param[in] septet_len Length of \a rdata
* \param[in] padding padding bits at start
* \returns number of bytes used in \a result */
int gsm_septets2octets(uint8_t *result, const uint8_t *rdata, uint8_t septet_len, uint8_t padding)
int gsm_septet_pack(uint8_t *result, const uint8_t *rdata, size_t septet_len, uint8_t padding)
{
int i = 0, z = 0;
uint8_t cb, nb;
@ -369,6 +369,12 @@ int gsm_septets2octets(uint8_t *result, const uint8_t *rdata, uint8_t septet_len
return z;
}
/*! Backwards compatibility wrapper for gsm_septets_pack(), deprecated. */
int gsm_septets2octets(uint8_t *result, const uint8_t *rdata, uint8_t septet_len, uint8_t padding)
{
return gsm_septet_pack(result, rdata, septet_len, padding);
}
/*! GSM 7-bit alphabet TS 03.38 6.2.1 Character packing
* \param[out] result Caller-provided output buffer
* \param[in] n Maximum length of \a result in bytes
@ -393,7 +399,7 @@ int gsm_7bit_encode_n(uint8_t *result, size_t n, const char *data, int *octets)
y = max_septets;
}
o = gsm_septets2octets(result, rdata, y, 0);
o = gsm_septet_pack(result, rdata, y, 0);
if (octets)
*octets = o;

1
src/gsm/libosmogsm.map
View File

@ -478,6 +478,7 @@ osmo_dump_gsmtime_c;
gsm_milenage;
gsm_septet_encode;
gsm_septet_pack;
gsm_septets2octets;
lapd_dl_exit;

4
tests/sms/sms_test.c
View File

@ -384,7 +384,7 @@ int main(int argc, char** argv)
memcpy(tmp, septet_data, concatenated_part1_septet_length);
/* In our case: test_multiple_decode[0].ud_hdr_ind equals number of padding bits*/
octet_length = gsm_septets2octets(coded, tmp, concatenated_part1_septet_length, test_multiple_encode[0].ud_hdr_ind);
octet_length = gsm_septet_pack(coded, tmp, concatenated_part1_septet_length, test_multiple_encode[0].ud_hdr_ind);
/* copy header */
memset(tmp, 0x42, sizeof(tmp));
@ -402,7 +402,7 @@ int main(int argc, char** argv)
memcpy(tmp, septet_data + concatenated_part1_septet_length, concatenated_part2_septet_length);
/* In our case: test_multiple_decode[1].ud_hdr_ind equals number of padding bits*/
octet_length = gsm_septets2octets(coded, tmp, concatenated_part2_septet_length, test_multiple_encode[1].ud_hdr_ind);
octet_length = gsm_septet_pack(coded, tmp, concatenated_part2_septet_length, test_multiple_encode[1].ud_hdr_ind);
/* copy header */
memset(tmp, 0x42, sizeof(tmp));

15
tests/sms/sms_test.ok
View File

@ -21,20 +21,15 @@ Result: len(12) data(14 d0 4f 78 d9 2d 9c 0e c3 e2 31 19 )
Running test_enc_large_msg
gsm_7bit_encode_n(len=2048) processed 2048 septets (expected 2048): OK
gsm_7bit_encode_n(len=2048) used 0 octets in the buffer (expected 1792): FAIL
Unexpected chunk at enc_buf[0:7]: 00 00 00 00 00 00 00
gsm_7bit_encode_n(len=2048) used 1792 octets in the buffer (expected 1792): OK
gsm_7bit_encode_n(len=1024) processed 1024 septets (expected 1024): OK
gsm_7bit_encode_n(len=1024) used 0 octets in the buffer (expected 896): FAIL
Unexpected chunk at enc_buf[0:7]: 00 00 00 00 00 00 00
gsm_7bit_encode_n(len=1024) used 896 octets in the buffer (expected 896): OK
gsm_7bit_encode_n(len=555) processed 555 septets (expected 555): OK
gsm_7bit_encode_n(len=555) used 38 octets in the buffer (expected 486): FAIL
Unexpected chunk at enc_buf[35:6]: c1 60 10 00 00 00
gsm_7bit_encode_n(len=555) used 486 octets in the buffer (expected 486): OK
gsm_7bit_encode_n(len=512) processed 512 septets (expected 512): OK
gsm_7bit_encode_n(len=512) used 0 octets in the buffer (expected 448): FAIL
Unexpected chunk at enc_buf[0:7]: 00 00 00 00 00 00 00
gsm_7bit_encode_n(len=512) used 448 octets in the buffer (expected 448): OK
gsm_7bit_encode_n(len=260) processed 260 septets (expected 260): OK
gsm_7bit_encode_n(len=260) used 4 octets in the buffer (expected 228): FAIL
Unexpected chunk at enc_buf[0:6]: c1 60 30 08 00 00
gsm_7bit_encode_n(len=260) used 228 octets in the buffer (expected 228): OK
gsm_7bit_encode_n(len=255) processed 255 septets (expected 255): OK
gsm_7bit_encode_n(len=255) used 224 octets in the buffer (expected 224): OK
gsm_7bit_encode_n(len=250) processed 250 septets (expected 250): OK