<p>Vadim Yanitskiy has uploaded this change for <strong>review</strong>.</p><p><a href="https://gerrit.osmocom.org/10183">View Change</a></p><pre style="font-family: monospace,monospace; white-space: pre-wrap;">BTS: fix: pad LAPDm frames before sending via L1CTL<br><br>Thanks to Stefan Sperling, a critical bug was discovered in trxcon.<br>The problem was that length of LAPDm frames was not checked before<br>passing them to the libosmocoding API. So, if a received LAPDm<br>frame is shorter than expected (i.e. 23 bytes), then:<br><br>  - in case of xCCH, there was a heap overflow (detected by ASAN),<br>    so a short frame has been encoded together with some garbage<br>    outside the primitive buffer...<br><br>  - in case of FACCH, as the length != 23, a frame was recognised<br>    as a speech frame, and also encoded together with some garbage.<br><br>Since the bug is fixed (OS#3415), some TTCN-3 BTS tests started<br>to fail, because most likely it was assumed that trxcon would<br>pad the frames automatically, but it doesn't and shouldn't.<br><br>Let's automatically pad LAPDm frames with 0x2b before sending.<br><br>Change-Id: I16cba4e4179456bebabf0638760af011a27fd333<br>Related: OS#3418<br>---<br>M bts/BTS_Tests.ttcn<br>M start-testsuite.sh<br>2 files changed, 9 insertions(+), 1 deletion(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/83/10183/1</pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/bts/BTS_Tests.ttcn b/bts/BTS_Tests.ttcn</span><br><span>index 40bfd24..2e27c10 100644</span><br><span>--- a/bts/BTS_Tests.ttcn</span><br><span>+++ b/bts/BTS_Tests.ttcn</span><br><span>@@ -3222,6 +3222,14 @@</span><br><span>            /* prepend dummy L1 header */</span><br><span>                l2 := '0000'O & l2;</span><br><span>      }</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+   /* If required, pad L2 frame with constant 0x02 filling */</span><br><span style="color: hsl(120, 100%, 40%);">+    var integer l2_len := lengthof(l2);</span><br><span style="color: hsl(120, 100%, 40%);">+   while (l2_len < 23) {</span><br><span style="color: hsl(120, 100%, 40%);">+              l2_len := l2_len + 1;</span><br><span style="color: hsl(120, 100%, 40%);">+         l2 := l2 & '2B'O;</span><br><span style="color: hsl(120, 100%, 40%);">+ }</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span>  log("encoding ", l, " to ", l2);</span><br><span>         L1CTL.send(ts_L1CTL_DATA_REQ(g_chan_nr, link_id, l2));</span><br><span> }</span><br><span>diff --git a/start-testsuite.sh b/start-testsuite.sh</span><br><span>index e2da8f0..e8d7fcc 100755</span><br><span>--- a/start-testsuite.sh</span><br><span>+++ b/start-testsuite.sh</span><br><span>@@ -21,7 +21,7 @@</span><br><span>         TEST=$3</span><br><span> fi</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-LD_LIBRARY_PATH="$SUITE_DIR:/usr/lib/titan:/usr/ttcn3/lib" ttcn3_start $SUITE $CFG $TEST</span><br><span style="color: hsl(120, 100%, 40%);">+LD_LIBRARY_PATH="$SUITE_DIR:/home/wmn/osmocom/titan.core/install/lib" ttcn3_start $SUITE $CFG $TEST</span><br><span> </span><br><span> expected="$SUITE_DIR/expected-results.xml"</span><br><span> if [ ! -f "$expected" ]; then</span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.osmocom.org/10183">change 10183</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.osmocom.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.osmocom.org/10183"/><meta itemprop="name" content="View Change"/></div></div>

<div style="display:none"> Gerrit-Project: osmo-ttcn3-hacks </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-MessageType: newchange </div>
<div style="display:none"> Gerrit-Change-Id: I16cba4e4179456bebabf0638760af011a27fd333 </div>
<div style="display:none"> Gerrit-Change-Number: 10183 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Vadim Yanitskiy <axilirator@gmail.com> </div>