This is merely a historical archive of years 2008-2021, before the migration to mailman3.
A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.
Vadim Yanitskiy gerrit-no-reply at lists.osmocom.orgVadim Yanitskiy has uploaded this change for review. ( https://gerrit.osmocom.org/13907 Change subject: libmsc/gsm_04_08.c: fix sizeof(pointer) instead of sizeof(struct) ...................................................................... libmsc/gsm_04_08.c: fix sizeof(pointer) instead of sizeof(struct) In gsm48_rx_mm_serv_req() we need to make sure that a given message buffer is large enough to contain both 'gsm48_hdr' and 'gsm48_service_request' structures. Comparing msg->data_len with size of pointer if wrong because: - we actually need to compare with size of struct(s), - we need msgb_l3len(), not length of the whole buffer. Change-Id: I6e7454d7a6f63fd5a0e12fb90d8c58688da0951e --- M src/libmsc/gsm_04_08.c 1 file changed, 19 insertions(+), 12 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/07/13907/1 diff --git a/src/libmsc/gsm_04_08.c b/src/libmsc/gsm_04_08.c index 32a7b7f..ac00025 100644 --- a/src/libmsc/gsm_04_08.c +++ b/src/libmsc/gsm_04_08.c @@ -738,28 +738,35 @@ { struct gsm_network *net = conn->network; uint8_t mi_type; - struct gsm48_hdr *gh = msgb_l3(msg); - struct gsm48_service_request *req = - (struct gsm48_service_request *)gh->data; + struct gsm48_hdr *gh; + struct gsm48_service_request *req; /* unfortunately in Phase1 the classmark2 length is variable */ - uint8_t classmark2_len = gh->data[1]; - uint8_t *classmark2 = gh->data+2; - uint8_t *mi_p = classmark2 + classmark2_len; - uint8_t mi_len = *mi_p; - uint8_t *mi = mi_p + 1; + uint8_t classmark2_len; + uint8_t *classmark2; + uint8_t *mi_p; + uint8_t mi_len; + uint8_t *mi; struct osmo_location_area_id lai; bool is_utran; lai.plmn = conn->network->plmn; lai.lac = conn->lac; - if (msg->data_len < sizeof(struct gsm48_service_request*)) { + /* Make sure that both header and CM Service Request fit into the buffer */ + if (msgb_l3len(msg) < sizeof(*gh) + sizeof(*req)) { LOG_RAN_CONN(conn, LOGL_ERROR, "Rx CM SERVICE REQUEST: wrong message size (%u < %zu)\n", - msg->data_len, sizeof(struct gsm48_service_request*)); - return msc_gsm48_tx_mm_serv_rej(conn, - GSM48_REJECT_INCORRECT_MESSAGE); + msgb_l3len(msg), sizeof(*gh) + sizeof(*req)); + return msc_gsm48_tx_mm_serv_rej(conn, GSM48_REJECT_INCORRECT_MESSAGE); } + gh = (struct gsm48_hdr *) msgb_l3(msg); + req = (struct gsm48_service_request *) gh->data; + classmark2_len = gh->data[1]; + classmark2 = gh->data + 2; + mi_p = classmark2 + classmark2_len; + mi_len = *mi_p; + mi = mi_p + 1; + if (msg->data_len < req->mi_len + 6) { LOG_RAN_CONN(conn, LOGL_ERROR, "Rx CM SERVICE REQUEST: message does not fit in packet\n"); return msc_gsm48_tx_mm_serv_rej(conn, -- To view, visit https://gerrit.osmocom.org/13907 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: I6e7454d7a6f63fd5a0e12fb90d8c58688da0951e Gerrit-Change-Number: 13907 Gerrit-PatchSet: 1 Gerrit-Owner: Vadim Yanitskiy <axilirator at gmail.com> -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20190508/585aaf8a/attachment.htm>