Fix out-of-bounds read in GtpV2Layer with truncated TEID-present header#2181
Open
vsaraikin wants to merge 2 commits into
Open
Fix out-of-bounds read in GtpV2Layer with truncated TEID-present header#2181vsaraikin wants to merge 2 commits into
vsaraikin wants to merge 2 commits into
Conversation
vsaraikin
marked this pull request as ready for review
July 10, 2026 10:17
Collaborator
|
Closing and reopen to run CI after base branch change. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #2181 +/- ##
==========================================
+ Coverage 82.66% 82.81% +0.14%
==========================================
Files 332 332
Lines 60155 60011 -144
Branches 12768 11799 -969
==========================================
- Hits 49727 49697 -30
- Misses 9019 9463 +444
+ Partials 1409 851 -558
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2171.
GtpV2Layer::isDataValidonly requiressizeof(gtpv2_basic_header) + sizeof(uint32_t)bytes (8 bytes). That is enough for the basic header plus the sequence-number word of a TEID-absent header, but when the TEID-present flag is set the fixed header additionally carries the 4-byte TEID before the sequence word:[basic header (4)][seq word (4)]→ 8 bytes[basic header (4)][TEID (4)][seq word (4)]→ 12 bytesSo a TEID-present packet of only 8 bytes passes validation, and
getSequenceNumber()(which advances an extra 4 bytes whenteidPresentis set) then reads a 32-bit word past the buffer — the OOB read reported in the issue (PoC48200008deadbeef, version 2 + TEID-present, 8 bytes).The fix makes
isDataValidrequire the extra 4 bytes when the TEID-present flag is set, so a truncated TEID-present header is rejected before any accessor can read past the buffer. The flag lives in the basic header, which is already covered by the existing minimum-length check, so reading it here is safe.Testing
GtpV2LayerParsingTest: the 8-byte TEID-present PoC is now rejected byisDataValid, while the same header with the sequence word present (12 bytes) is accepted.isDataValidaccepts the truncated packet (the assertion fails, and the underlyinggetSequenceNumberread is OOB).Packet++Testsuite passes (258/258).