rohc

Decompressor: crash caused by malformed (too short) IR and IR-DYN packets

Bug #1090069 reported by Didier Barvaux
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
rohc
Status tracked in Rohc-main
1.3.x
Invalid
Undecided
Didier Barvaux
rohc 1.3.5
1.4.x
Invalid
Undecided
Didier Barvaux
rohc 1.4.3
Rohc-1.5.x
Fix Released
Critical
Didier Barvaux
rohc 1.5.2
Rohc-main
Fix Released
Critical
Didier Barvaux
rohc 1.6.0

Bug Description

When parsing malformed IR and IR-DYN packets that are too short, the decompressor may crash because it does not properly check for the packet length before accessing data.

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Confirmed on main branch.

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Confirmed on branch 1.5.x.

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Fixed on main branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/main/revision/624

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Fixed in 1.5.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.5.x/revision/547

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Confirmed on 1.4.x branch.

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Fixed on 1.4.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.4.x/revision/358

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Branch 1.3.x is not affected.

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

In fact, branch 1.4.x was not affected. The rohc_ir_packet_crc_ok() function checks for minimal length.

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Additional length checks added for 1.5.x and main branches. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.5.x/revision/548 and http://bazaar.launchpad.net/~didier-barvaux/rohc/main/revision/625

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.