This is merely a historical archive of years 2008-2021, before the migration to mailman3.
A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.
laforge gerrit-no-reply at lists.osmocom.orglaforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-msc/+/25934 ) Change subject: smpp_mirror: Don't allocate msgb's for unrealistic amounts of memory ...................................................................... smpp_mirror: Don't allocate msgb's for unrealistic amounts of memory If the remote ESME would send us 0xffffffff as length field, don't try to allocte 4GB of memory, but bail out. Change-Id: I561f75210811826de06ea1673eca1df24faaa210 Fixes: CID#240738 --- M src/utils/smpp_mirror.c 1 file changed, 5 insertions(+), 0 deletions(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/utils/smpp_mirror.c b/src/utils/smpp_mirror.c index 883c498..72d15e3 100644 --- a/src/utils/smpp_mirror.c +++ b/src/utils/smpp_mirror.c @@ -246,6 +246,10 @@ esme->read_idx += rc; if (esme->read_idx >= sizeof(uint32_t)) { esme->read_len = ntohl(len); + if (esme->read_len > 65535) { + /* unrealistic */ + goto dead_socket; + } msg = msgb_alloc(esme->read_len, "SMPP Rx"); if (!msg) return -ENOMEM; @@ -283,6 +287,7 @@ osmo_fd_unregister(&esme->wqueue.bfd); close(esme->wqueue.bfd.fd); esme->wqueue.bfd.fd = -1; + esme_read_state_reset(esme); exit(2342); return 0; -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/25934 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I561f75210811826de06ea1673eca1df24faaa210 Gerrit-Change-Number: 25934 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge at osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge at osmocom.org> Gerrit-Reviewer: osmith <osmith at sysmocom.de> Gerrit-Reviewer: pespin <pespin at sysmocom.de> Gerrit-MessageType: merged -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20211025/ff31aee2/attachment.htm>