aboutsummaryrefslogtreecommitdiffstats
path: root/asn1
diff options
context:
space:
mode:
authorNeels Hofmeyr <neels@hofmeyr.de>2017-12-20 23:14:45 +0100
committerNeels Hofmeyr <neels@hofmeyr.de>2017-12-20 23:31:45 +0100
commit6eeef115a9096b954dd6d873978abbb28055d301 (patch)
treeb8087e3385f1365b128004039fa0f985635b0bcb /asn1
parent66d6d760aab222c91bec5134c228ffc13f463235 (diff)
hnbap,rua,ranap decode: fix segfault on decode error
Looking at hnbap_decode_hnbregisterrequesties(), I noticed a segfault if decoding the HNB Register Request PDU fails, which is due to an unchecked return value in code generated by asn1tostruct.py. Add return value and NULL pointer checks and hence fix null dereference on erratic PDUs across HNBAP, RUA and RANAP protocols. Similar checks exist in other places, this one was simply missing. Since the result of asn1tostruct.py is not committed, here is an example diff of the resulting change, of which there are 128 instances in total: @@ -304,7 +329,12 @@ memset(hnbRegisterRequestIEs, 0, sizeof(HNBRegisterRequestIEs_t)); HNBAP_DEBUG("Decoding message HNBRegisterRequestIEs (%s:%d)\n", __FILE__, __LINE__); - ANY_to_type_aper(any_p, &asn_DEF_HNBRegisterRequest, (void**)&hNBRegisterRequest_p); + tempDecoded = ANY_to_type_aper(any_p, &asn_DEF_HNBRegisterRequest, (void**)&hNBRegisterRequest_p); + + if (tempDecoded < 0 || hNBRegisterRequest_p == NULL) { + HNBAP_DEBUG("Decoding of message HNBRegisterRequestIEs failed\n"); + return -1; + } for (i = 0; i < hNBRegisterRequest_p->hnbRegisterRequest_ies.list.count; i++) { IE_t *ie_p; Change-Id: I6cb9cc9a88d22f03befa43f0968a874476fa079d
Diffstat (limited to 'asn1')
-rwxr-xr-xasn1/utils/asn1tostruct.py7
1 files changed, 6 insertions, 1 deletions
diff --git a/asn1/utils/asn1tostruct.py b/asn1/utils/asn1tostruct.py
index 8364c27..5586e40 100755
--- a/asn1/utils/asn1tostruct.py
+++ b/asn1/utils/asn1tostruct.py
@@ -311,7 +311,12 @@ for key in iesDefs:
f.write(" memset(%s, 0, sizeof(%s_t));\n" % (lowerFirstCamelWord(re.sub('-', '_', key)), prefix + re.sub('-', '_', key)))
f.write(" %s_DEBUG(\"Decoding message %s (%%s:%%d)\\n\", __FILE__, __LINE__);\n\n" % (fileprefix.upper(), prefix + re.sub('-', '_', keyName)))
- f.write(" ANY_to_type_aper(any_p, &asn_DEF_%s, (void**)&%s_p);\n\n" % (asn1cStruct, asn1cStructfirstlower))
+ f.write(" tempDecoded = ANY_to_type_aper(any_p, &asn_DEF_%s, (void**)&%s_p);\n\n" % (asn1cStruct, asn1cStructfirstlower))
+ f.write(" if (tempDecoded < 0 || %s_p == NULL) {\n" % (asn1cStructfirstlower))
+ f.write(" %s_DEBUG(\"Decoding of message %s failed\\n\");\n" % (fileprefix.upper(), prefix + re.sub('-', '_', keyName)))
+ f.write(" return -1;\n")
+ f.write(" }\n\n")
+
f.write(" for (i = 0; i < %s_p->%slist.count; i++) {\n" % (asn1cStructfirstlower, iesaccess))
f.write(" %sIE_t *ie_p;\n" % (prefix))
f.write(" ie_p = %s_p->%slist.array[i];\n" % (asn1cStructfirstlower, iesaccess))