Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Infinite loop finded in gtvp1::gtpu when unmarshalling with an UDPPort length at zero. #2

Closed
Vadimador opened this issue Sep 26, 2023 · 1 comment
Assignees

Comments

@Vadimador
Copy link

Vadimador commented Sep 26, 2023

Hello ! I found an infinite loop in your library. Here is some information on how to reproduce it :

versions

  • Debian GNU/Linux 11 (bullseye)
  • table-x86_64-unknown-linux-gnu unchanged - rustc 1.72.0 (5680fa18f 2023-08-23)

To reproduce :

we clone the repository :
git clone https://github.com/ErvinsK/gtp-rs.git
we add this main.rs to gtp-rs/src :

use ::gtp_rs::gtpv1::gtpu::*;

fn main() {

    // we create the extension_header
    let mut ext_header = UDPPort::default();
    ext_header.length = 0; // <-- the infinite loop is probably due to the length being 0
     
    // we add it to the header
    let mut header = Gtpv1Header::default();
    header.extension_headers = Some(vec![ExtensionHeader::UDPPort(ext_header)]);
 
    let mut array:Vec<u8> = vec![];
    header.marshal(&mut array);
    let _ = Gtpv1Header::unmarshal(&array); // <-- the infinite-loop happen when we try to unmarshal
    
}

we build and run :
cargo build && cargo run

ErvinsK added a commit that referenced this issue Oct 9, 2023
…revent infinite loops in all other GTPv1 and GTPv2 elements
@ErvinsK
Copy link
Owner

ErvinsK commented Oct 9, 2023

Issue fixed - additional check implemented to prevent the infinite loops and exit properly with an error with length is set to zero.

@ErvinsK ErvinsK closed this as completed Oct 9, 2023
@ErvinsK ErvinsK self-assigned this Oct 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants