apply correct bounds for various array inputs

[nathaniel-bennett]

Fixes several out-of-bounds memory accesses that can be triggered via an unauthenticated cellular device.

Partially deals with #143, though the ASN.1 files for S1AP will still need to be regenerated using a new version of the asn1c compiler (e.g. https://github.com/mouse07410/asn1c) in order to resolve the buffer overflow issues contained within it. It appears to be a static-compiled library that is stored in the git repo and linked at build time.

[omecproject]

Can one of the admins verify this patch?

[omecproject]

Can one of the admins verify this patch?

[omecproject]

Can one of the admins verify this patch?

[omecproject]

Can one of the admins verify this patch?

[thakurajayL]

How did you arrive at 300?

[nathaniel-bennett]

The destination of the memcpy is s1Msg->nasMsg.nasMsgBuf. s1Msg is of type initial_ue_msg_t, which has the following definition:

Nucleus/include/common/msgType.h

Lines 603 to 614 in a8002eb

	struct initial_ue_msg {
	s1_incoming_msg_header_t header;
	rawNas_Q_msg_t nasMsg;
	int enb_fd;
	int criticality;
	unsigned char IMSI[BINARY_IMSI_LEN];
	struct TAI tai;
	struct CGI utran_cgi;
	enum ie_RRC_est_cause rrc_cause;
	struct STMSI s_tmsi;
	}__attribute__ ((packed));
	typedef struct initial_ue_msg initial_ue_msg_t;

Following from that, the rawNas_Q_msg_t type has definition:

Nucleus/include/common/msgType.h

Lines 114 to 118 in a8002eb

	struct rawNas_Q_msg {
	uint8_t nasMsgBuf[MAX_NAS_MSG_SIZE];
	uint16_t nasMsgSize;
	}__attribute__ ((packed));
	typedef struct rawNas_Q_msg rawNas_Q_msg_t;

... which actually uses MAX_NAS_MSG_SIZE, equal to 500 bytes. My bad. I think I had seen the general nasMsgBuf field in several other types having a constant of 300, such as:

Nucleus/include/common/msgType.h

Lines 339 to 347 in a8002eb

	struct authreq_info {
	msg_type_t msg_type;
	int ue_idx;
	int enb_s1ap_ue_id;
	int enb_fd;
	uint8_t nasMsgBuf[300];
	uint8_t nasMsgSize;
	}__attribute__ ((packed));
	typedef struct authreq_info authreq_info_t;

... and wrongly assumed they would be consistent across all message types. I'll get that fixed.

[thakurajayL]

same comment - how you arrived at 300?

[nathaniel-bennett]

I relied on the same assumption as above, which may be wrong. In this case, s1Msg is of type uplink_nas_t, which is defined here:

Nucleus/include/common/msgType.h

Lines 616 to 631 in a8002eb

	struct uplink_nas {
	s1_incoming_msg_header_t header;
	rawNas_Q_msg_t nasMsg;
	int enb_fd;
	uint32_t s1ap_enb_ue_id;
	uint32_t s1ap_mme_ue_id;
	struct TAI tai;
	struct CGI utran_cgi;
	struct STMSI s_tmsi;
	}__attribute__ ((packed));
	typedef struct uplink_nas uplink_nas_t;
	struct ue_context_rel_req {
	s1_incoming_msg_header_t header;
	}__attribute__ ((packed));
	typedef struct ue_context_rel_req ue_context_rel_req_t;

It likewise uses a rawNas_Q_msg_t:

Nucleus/include/common/msgType.h

Lines 114 to 118 in a8002eb

	struct rawNas_Q_msg {
	uint8_t nasMsgBuf[MAX_NAS_MSG_SIZE];
	uint16_t nasMsgSize;
	}__attribute__ ((packed));
	typedef struct rawNas_Q_msg rawNas_Q_msg_t;

So yes, it should be changed to MAX_NAS_MSG_SIZE as well. Ill get this fixed too.

[thakurajayL]

May need formatting of the code..seems space & tab combination. Could you pls fix it?

[nathaniel-bennett]

Fixed 👍

[gab-arrobo]

@nathaniel-bennett, you need to "redo" your commit using the -s flag to pass the DCO check. You see details here: https://wiki.linuxfoundation.org/dco

[nathaniel-bennett]

Alright, I've gone ahead and force-pushed the requested changes (including -s addition to the commit).