Possible decompressor crash with malformed extension header list

[Didier Barvaux]

The ROHC decompressor does not check correctly the length of the ROHC packet before parsing the item part of the extension header list. If the item is malformed, the ROHC decompressor may read too many bytes and parses data that was not part of the ROHC packet. Depending on those bytes, it might fail softly or crash.

It might have security implications if someone is able to send malformed ROHC packets to a ROHC decompressor.

Solution: always check the ROHC packet length before reading items of extension header lists.

Please find attached one IR packet with a malformed extension list of type 0.

[Didier Barvaux (didier-barvaux)]

Fixed on main branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/main/revision/634

[Didier Barvaux (didier-barvaux)]

Fixed in 1.5.x. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.5.x/revision/575

[Didier Barvaux (didier-barvaux)]

Fixed in 1.4.x. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.4.x/revision/371

[Didier Barvaux (didier-barvaux)]

Bug will not be fixed in the 1.3.x releases. This is too much work to backport the fixes from newer branches (code changed in many ways).

As a consequence, do not use any 1.3.x release with ROHC packets coming from untrusted sources or with IPv6 traffic.