neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/32421 )
Change subject: fix length check in abis_rsl_rx_rll()
......................................................................
fix length check in abis_rsl_rx_rll()
In abis_rsl_rx_rll(), we do the following header length check -- quick
challenge, can you spot the two bugs hidden here?
struct abis_rsl_rll_hdr *rllh;
if (msgb_l2len(msg) >
sizeof(struct abis_rsl_common_hdr) + sizeof(*rllh))
msg->l3h = &rllh->data[3];
Fix these bugs:
- struct abis_rsl_common_hdr is already included as the first member of
abis_rsl_rll_hdr, no need to add that.
- We are going to be accessing rrlh->data[3], so we must check for at
least sizeof(*rllh) + 4.
Change-Id: Ie4aee615c8c904ae8308ec0074d8bc5208137061
---
M src/osmo-bsc/abis_rsl.c
1 file changed, 26 insertions(+), 4 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/21/32421/1
diff --git a/src/osmo-bsc/abis_rsl.c b/src/osmo-bsc/abis_rsl.c
index 6370942..2fc640b 100644
--- a/src/osmo-bsc/abis_rsl.c
+++ b/src/osmo-bsc/abis_rsl.c
@@ -2500,8 +2500,7 @@
switch (rllh->c.msg_type) {
case RSL_MT_DATA_IND:
LOG_LCHAN(msg->lchan, LOGL_DEBUG, "SAPI=%u DATA INDICATION\n", sapi);
- if (msgb_l2len(msg) >
- sizeof(struct abis_rsl_common_hdr) + sizeof(*rllh) &&
+ if (msgb_l2len(msg) > (sizeof(*rllh) + 3) &&
rllh->data[0] == RSL_IE_L3_INFO) {
msg->l3h = &rllh->data[3];
return gsm0408_rcvmsg(msg, rllh->link_id);
@@ -2543,8 +2542,7 @@
msg->lchan->sapis[sapi] = LCHAN_SAPI_MS;
osmo_fsm_inst_dispatch(msg->lchan->fi, LCHAN_EV_RLL_ESTABLISH_IND, msg);
- if (msgb_l2len(msg) >
- sizeof(struct abis_rsl_common_hdr) + sizeof(*rllh) &&
+ if (msgb_l2len(msg) > (sizeof(*rllh) + 3) &&
rllh->data[0] == RSL_IE_L3_INFO) {
msg->l3h = &rllh->data[3];
return gsm0408_rcvmsg(msg, rllh->link_id);
--
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/32421
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-bsc
Gerrit-Branch: master
Gerrit-Change-Id: Ie4aee615c8c904ae8308ec0074d8bc5208137061
Gerrit-Change-Number: 32421
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-MessageType: newchange
Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmocom-bb/+/32420
to look at the new patch set (#2).
Change subject: layer23: modem: Fix wrong 'radio not started' vty message
......................................................................
layer23: modem: Fix wrong 'radio not started' vty message
Change-Id: I8871c9d0e820beb75d7820b5a2d8d3c77dac379d
---
M src/host/layer23/src/common/vty.c
M src/host/layer23/src/modem/app_modem.c
2 files changed, 15 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/20/32420/2
--
To view, visit https://gerrit.osmocom.org/c/osmocom-bb/+/32420
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmocom-bb
Gerrit-Branch: master
Gerrit-Change-Id: I8871c9d0e820beb75d7820b5a2d8d3c77dac379d
Gerrit-Change-Number: 32420
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-MessageType: newpatchset
Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmocom-bb/+/32419
to look at the new patch set (#2).
Change subject: layer23: Move testsim node to common/
......................................................................
layer23: Move testsim node to common/
Change-Id: Ife34403a715809b43e7a4cd5ce4dec8616fc08af
---
M src/host/layer23/include/osmocom/bb/common/vty.h
M src/host/layer23/include/osmocom/bb/mobile/vty.h
M src/host/layer23/src/common/vty.c
M src/host/layer23/src/mobile/vty_interface.c
4 files changed, 319 insertions(+), 301 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmocom-bb refs/changes/19/32419/2
--
To view, visit https://gerrit.osmocom.org/c/osmocom-bb/+/32419
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmocom-bb
Gerrit-Branch: master
Gerrit-Change-Id: Ife34403a715809b43e7a4cd5ce4dec8616fc08af
Gerrit-Change-Number: 32419
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-MessageType: newpatchset