srsGNB out-of-bound shift problem in pseudo_random_generator
lbm98 opened this issue · 0 comments
lbm98 commented
Issue Description
srsGNB does an out-of-bound shift within the random number generator at the two places:
Setup Details
Can be reproduced by compiling the test suite with UndefinedBehaviorSanitizer enabled
and executing the following testsuite.
cmake \
-B build-ubsan \
-G Ninja \
-DCMAKE_CXX_COMPILER=clang++ \
-DCMAKE_CXX_FLAGS="-fsanitize=undefined -fno-sanitize-recover=all"
Expected Behavior
The shift stays in-bound of the data type.
Actual Behaviour
UndefinedBehaviorSanitizer generates the following two errors
runtime error: shift exponent 4294967288 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /srs/srsRAN_Project/lib/phy/upper/sequence_generators/pseudo_random_generator_impl.cpp:127:33
runtime error: shift exponent 4294967288 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /srs/srsRAN_Project/lib/phy/upper/sequence_generators/pseudo_random_generator_impl.cpp:299:50
Steps to reproduce the problem
Covered in setup details.
Additional Information
Out-of-bound shifts are undefined behavior which can lead to a security vulnerability.