• Cedric Roux's avatar
    security EIA1: bugfix: memory alignment + read out of array · fc42a2a5
    Cedric Roux authored
    Compiling the nrUE with -fsanitize=undefined leads to a crash
    because the function nas_stream_encrypt_eia1() accesses the data
    as uint32_t but the data is not aligned.
    
    Actually this function wants 64 bits (big-endian) of data, so let's
    introduce a simple function to read a big-endian 64 bits value.
    It may seem bad (unoptimized), but looking at the output of gcc
    without -fsanitize=undefined this will be translated as just one
    movbeq instruction (on the machine where I did the test), which is
    actually less instructions than the previous version which was doing
    too movbel plus orq.
    
    Moreover, after the main loop we need to process the last remaining
    bytes (so less than 8). The code was wrong, reading past the input
    data (and also not caring about alignment). It may work, it may fail,
    it depends on many things. But it's plain wrong. So this was replaced
    for something better, simpler. No need for mask32bit() anymore, only
    one call to U64() is needed.
    
    And now -fsanitize=undefined is happy, so all is good.
    
    We also restrict the input length to be multiple of 8 bits. I don't
    think it's a problem. To be refined if I'm wrong. (I think RRC and
    NAS messages are 8-bits aligned, so it shouldn't be a problem.)
    fc42a2a5
nas_stream_eia1.c 6.99 KB