From e454b4adb3cf4b635b452ac2be55736ff507a96b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 20 Mar 2026 15:48:41 +0100 Subject: [PATCH] libsimaka: Prevent out-of-bounds read when parsing attributes with actual length field These attributes contain a 16-bit length field for the actual length of the data in bits or bytes, as compared to the length in 4-byte blocks in the attribute header. The previous code didn't correctly account for the length of the fixed header (4 bytes) when it compared the parsed length to the length in the header. This could cause an out-of-bounds read of up to four bytes beyond the end of the attribute/message. Fixes: f8330d03953b ("Added a libsimaka library with shared message handling code for EAP-SIM/AKA") --- src/libsimaka/simaka_message.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libsimaka/simaka_message.c b/src/libsimaka/simaka_message.c index 670656811..52c6f83e2 100644 --- a/src/libsimaka/simaka_message.c +++ b/src/libsimaka/simaka_message.c @@ -374,7 +374,7 @@ static bool parse_attributes(private_simaka_message_t *this, chunk_t in) { uint16_t len; - if (hdr->length < 1 || in.len < 4) + if (hdr->length < 1 || in.len < hdr->length * 4) { return invalid_length(hdr->type); } @@ -384,7 +384,7 @@ static bool parse_attributes(private_simaka_message_t *this, chunk_t in) { /* AT_RES uses length encoding in bits */ len /= 8; } - if (len > hdr->length * 4 || len > in.len) + if (len > hdr->length * 4 - 4) { return invalid_length(hdr->type); }