August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in libosmo-sigtran[master]: TCAP: UDTS routing: stop overwriting ASP when routing UDTS
by lynxis lazus 09 Aug '26

09 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43193?usp=email ) Change subject: TCAP: UDTS routing: stop overwriting ASP when routing UDTS ...................................................................... TCAP: UDTS routing: stop overwriting ASP when routing UDTS The UDTS routing decision is final and should not go to the tcap routing a second time as a normal packet. Change-Id: I1c4eaaf352d505970e55e04c605c100d64aaaa34 --- M src/tcap_as_loadshare.c 1 file changed, 2 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/93/43193/1 diff --git a/src/tcap_as_loadshare.c b/src/tcap_as_loadshare.c index bd7548f..3bd0db2 100644 --- a/src/tcap_as_loadshare.c +++ b/src/tcap_as_loadshare.c @@ -614,6 +614,8 @@ asp = tcap_as_asp_find_by_tcap_id(as, &called_addr, &calling_addr, *otid); if (!asp) LOGPAS(as, DLTCAP, LOGL_NOTICE, "Could not find an ASP for UDTS with otid %u/dtid %u\n", parsed.otid, parsed.dtid); + + goto out_free_sua; } /* TCAP messages towards the IPA nodes */ -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43193?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I1c4eaaf352d505970e55e04c605c100d64aaaa34 Gerrit-Change-Number: 43193 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[S] Change in libosmo-sigtran[master]: TCAP: LOG: fix missing newlines in log messages
by lynxis lazus 09 Aug '26

09 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43194?usp=email ) Change subject: TCAP: LOG: fix missing newlines in log messages ...................................................................... TCAP: LOG: fix missing newlines in log messages Change-Id: Id57d8afeb01412ed7448bb27148be87980f4f906 --- M src/tcap_trans_tracking.c 1 file changed, 8 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/94/43194/1 diff --git a/src/tcap_trans_tracking.c b/src/tcap_trans_tracking.c index a5a0ca6..421ad7b 100644 --- a/src/tcap_trans_tracking.c +++ b/src/tcap_trans_tracking.c @@ -366,7 +366,8 @@ hash_for_each_safe(as->tcap.trans_track_own, i, tmp, entry, own_tid.list) { if (entry->asp == asp) { count++; - LOGPASP(entry->asp, DLTCAP, LOGL_DEBUG, "Remove Cache entry for tcap own tid %u (asp removed)", entry->own_tid.tid); + LOGPASP(entry->asp, DLTCAP, LOGL_DEBUG, "Remove Cache entry for tcap own tid %u (asp removed)\n", + entry->own_tid.tid); tcap_trans_track_entry_free(entry); } } @@ -374,7 +375,8 @@ hash_for_each_safe(as->tcap.trans_track_peer, i, tmp, entry, peer_tid.list) { if (entry->asp == asp) { count++; - LOGPASP(entry->asp, DLTCAP, LOGL_DEBUG, "Remove Cache entry for tcap own tid %u (asp removed)", entry->peer_tid.tid); + LOGPASP(entry->asp, DLTCAP, LOGL_DEBUG, "Remove Cache entry for tcap own tid %u (asp removed)\n", + entry->peer_tid.tid); tcap_trans_track_entry_free(entry); } } @@ -390,13 +392,15 @@ hash_for_each_safe(as->tcap.trans_track_own, i, tmp, entry, own_tid.list) { count++; - LOGPASP(entry->asp, DLTCAP, LOGL_DEBUG, "Remove Cache entry for tcap own tid %u (as removed)", entry->own_tid.tid); + LOGPASP(entry->asp, DLTCAP, LOGL_DEBUG, "Remove Cache entry for tcap own tid %u (as removed)\n", + entry->own_tid.tid); tcap_trans_track_entry_free(entry); } hash_for_each_safe(as->tcap.trans_track_peer, i, tmp, entry, peer_tid.list) { count++; - LOGPASP(entry->asp, DLTCAP, LOGL_DEBUG, "Remove Cache entry for tcap own tid %u (as removed)", entry->peer_tid.tid); + LOGPASP(entry->asp, DLTCAP, LOGL_DEBUG, "Remove Cache entry for tcap own tid %u (as removed)\n", + entry->peer_tid.tid); tcap_trans_track_entry_free(entry); } -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43194?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Id57d8afeb01412ed7448bb27148be87980f4f906 Gerrit-Change-Number: 43194 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[M] Change in libosmo-sigtran[master]: TCAP: implement fallback routing when no TCAP ASP can be found.
by lynxis lazus 09 Aug '26

09 Aug '26

Attention is currently required from: daniel, laforge, pespin. lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008?usp=email ) Change subject: TCAP: implement fallback routing when no TCAP ASP can be found. ...................................................................... Patch Set 3: (5 comments) File src/ss7_as_vty.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008/comment/d686c291_162c9… : PS3, Line 266: DEFUN_USRATTR(as_tcap_unroutable_route_fallback, as_tcap_unroutable_route_fallback_cmd, > It probably make much more sense to have a VTY cmd […] Done File src/tcap_as_loadshare.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008/comment/3493aa81_64fce… : PS3, Line 470: if (as->cfg.loadshare.tcap.unroutable_tcap_fallback_dpc == 0) > this is imho incorrect. 0 is a valid DPC afaiu. […] Done https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008/comment/66242a19_8da0f… : PS3, Line 474: new_mtp.opc = orig_mtp->opc; > this line is a noop, cam be dropped. Done https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008/comment/612da7d8_44775… : PS3, Line 487: * \return 0 on success and asp is set, < 0 on error, > 0 when message is routed elsewhere > I see you are updating the return signature here, but I see no modficiation on any code using the fu […] the code already handles the different rc. https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008/comment/e47defe6_5a5ea… : PS3, Line 508: /* Message is handled and will be routed else where */ > elsewhere Done -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I3e4e634b38a1845c2ce62a3805ff91a530520d88 Gerrit-Change-Number: 43008 Gerrit-PatchSet: 3 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Comment-Date: Sat, 08 Aug 2026 15:58:41 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: TCAP: Refactoring unroutable messages into own function
by lynxis lazus 09 Aug '26

09 Aug '26

Attention is currently required from: daniel, laforge, pespin. Hello Jenkins Builder, daniel, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: TCAP: Refactoring unroutable messages into own function ...................................................................... TCAP: Refactoring unroutable messages into own function In preparation of adding another method to handle those. Change-Id: Ib4d114273423730418458767d17b11de9bd815d4 --- M src/tcap_as_loadshare.c 1 file changed, 65 insertions(+), 12 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/07/43007/3 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ib4d114273423730418458767d17b11de9bd815d4 Gerrit-Change-Number: 43007 Gerrit-PatchSet: 3 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: TCAP: implement fallback routing when no TCAP ASP can be found.
by lynxis lazus 09 Aug '26

09 Aug '26

Attention is currently required from: daniel, laforge, lynxis lazus. Hello Jenkins Builder, daniel, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008?usp=email to look at the new patch set (#4). The following approvals got outdated and were removed: Code-Review+1 by laforge, Verified+1 by Jenkins Builder Change subject: TCAP: implement fallback routing when no TCAP ASP can be found. ...................................................................... TCAP: implement fallback routing when no TCAP ASP can be found. If a TCAP message from an ongoing session can't be routed by either the TCAP session cache or by the destination TID to a known ASP, allow to route the packet to a different destination. Change-Id: I3e4e634b38a1845c2ce62a3805ff91a530520d88 --- M src/ss7_as.c M src/ss7_as.h M src/ss7_as_vty.c M src/tcap_as_loadshare.c 4 files changed, 75 insertions(+), 9 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/08/43008/4 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I3e4e634b38a1845c2ce62a3805ff91a530520d88 Gerrit-Change-Number: 43008 Gerrit-PatchSet: 4 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: stp: TCAP: re-work tests as the TCAP routing changed
by lynxis lazus 09 Aug '26

09 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43192?usp=email ) Change subject: stp: TCAP: re-work tests as the TCAP routing changed ...................................................................... stp: TCAP: re-work tests as the TCAP routing changed Original the TCAP routing was designed in a different way. The original concept was to load-balance the TCAP sessions when they originate from M3UA -> IPA by the oTID. This changed into load-balancing TCAP sessions from M3UA -> IPA and track the session with the IPA/TCAP ids. Change-Id: Ib97a158fe544a72231aa31a7ec226736eeb32fcb --- M stp/STP_Tests_TCAP.ttcn 1 file changed, 4 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/92/43192/1 diff --git a/stp/STP_Tests_TCAP.ttcn b/stp/STP_Tests_TCAP.ttcn index bc16337..16874b2 100644 --- a/stp/STP_Tests_TCAP.ttcn +++ b/stp/STP_Tests_TCAP.ttcn @@ -608,7 +608,7 @@ tcap_rt_msg.u.add_range.tid_end := 199; f_asp_tx_ipa_ext_tcap_routing(tcap_rt_msg, 3); - f_asp_tx_tcap_m3ua_ipa_transaction(0, 2, int2oct(2345, 4), int2oct(42, 4)); + f_asp_tx_tcap_m3ua_ipa_continue(0, 2, int2oct(2345, 4), int2oct(42, 4)); setverdict(pass); } @@ -760,7 +760,7 @@ pc := tcap_configs[2].cfg.own_pc, ssn := tcap_configs[2].cfg.own_ssn); f_asp_tx_ipa_ext_tcap_routing(tcap_rt_msg, 3); - f_asp_tx_tcap_m3ua_ipa_transaction(0, 3, int2oct(60, 4), int2oct(70, 4)); + f_asp_tx_tcap_m3ua_ipa_continue(0, 3, int2oct(60, 4), int2oct(70, 4)); setverdict(pass); } @@ -787,7 +787,8 @@ pc := IPA_EXT_TCAP_ROUTING_PC_WILDCARD, ssn := tcap_configs[2].cfg.own_ssn); f_asp_tx_ipa_ext_tcap_routing(tcap_rt_msg, 3); - f_asp_tx_tcap_m3ua_ipa_transaction(0, 3, int2oct(60, 4), int2oct(99, 4)); + f_asp_tx_tcap_m3ua_ipa_continue(0, 3, int2oct(79, 4), int2oct(60, 4)); + f_asp_tx_tcap_m3ua_ipa_continue(0, 2, int2oct(79, 4), int2oct(81, 4)); setverdict(pass); } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43192?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ib97a158fe544a72231aa31a7ec226736eeb32fcb Gerrit-Change-Number: 43192 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[S] Change in libosmocore[master]: gsm0480: fix out-of-bounds read in parse_process_uss_req()
by fixeria 09 Aug '26

09 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43191?usp=email ) Change subject: gsm0480: fix out-of-bounds read in parse_process_uss_req() ...................................................................... gsm0480: fix out-of-bounds read in parse_process_uss_req() The USSD-String octet count (uss_req_data[6]) was only checked against the 160-byte GSM0480_USSD_OCTET_STRING_LEN destination limit, never against the number of bytes actually remaining in the received message. A truncated ProcessUnstructuredSS-Request (as short as 8 bytes) with a length byte up to 160 caused the subsequent memcpy() (and, for the default alphabet, gsm_7bit_decode_n_ussd()) to read up to ~159 bytes past the end of the message buffer. uss_req_data/length come straight from a received L3 message via the public gsm0480_decode_ss_request() API, so this is reachable with network-supplied input. Add the missing length check, mirroring the one already present in the sibling parse_process_uss_data(), and add a regression test with an oversized length byte. Change-Id: I62a2ea539238d8c2dbab897ce2f80b9ab905a108 Fixes: OS#7045 --- M src/gsm/gsm0480.c M tests/ussd/ussd_test.c M tests/ussd/ussd_test.ok 3 files changed, 34 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/91/43191/1 diff --git a/src/gsm/gsm0480.c b/src/gsm/gsm0480.c index 7a7f71f..a8eac6b 100644 --- a/src/gsm/gsm0480.c +++ b/src/gsm/gsm0480.c @@ -704,6 +704,8 @@ dcs = uss_req_data[4]; /* Get the amount of bytes */ num_chars = uss_req_data[6]; + if (num_chars > length - 7) + return 0; /* Drop messages with incorrect length */ if (num_chars > GSM0480_USSD_OCTET_STRING_LEN) { diff --git a/tests/ussd/ussd_test.c b/tests/ussd/ussd_test.c index 2b8321d..b131a89 100644 --- a/tests/ussd/ussd_test.c +++ b/tests/ussd/ussd_test.c @@ -41,6 +41,16 @@ 0x05, 0x02, 0x01, 0x24 }; +/* Same REGISTER/ProcessUssReq message as ussd_request[], except the + * USSD-String octet count (index 18) claims 100 bytes while the message + * only ever carries 6. Must be rejected, not read past the buffer end. */ +static const uint8_t ussd_process_uss_req_overflow[] = { + 0x0b, 0x7b, 0x1c, 0x15, 0xa1, 0x13, 0x02, 0x01, + 0x03, 0x02, 0x01, 0x3b, 0x30, 0x0b, 0x04, 0x01, + 0x0f, 0x04, 0x64, 0x2a, 0xd5, 0x4c, 0x16, 0x1b, + 0x01, 0x7f, 0x01, 0x00 +}; + static const uint8_t interrogate_ss[] = { 0x0b, 0x7b, 0x1c, 0x0d, 0xa1, 0x0b, 0x02, 0x01, 0x03, 0x02, 0x01, 0x0e, 0x30, 0x03, 0x04, 0x01, @@ -221,6 +231,23 @@ printf("\n"); } +/* parse_process_uss_req() must reject a USSD-String octet count that + * exceeds the bytes actually remaining in the message, rather than only + * capping it against GSM0480_USSD_OCTET_STRING_LEN and reading past the + * end of the buffer. */ +static void test_process_uss_req_overflow(void) +{ + int rc; + + printf("[i] Testing parse_process_uss_req() against an oversized " + "USSD-String length\n"); + + rc = parse_ussd(ussd_process_uss_req_overflow, sizeof(ussd_process_uss_req_overflow)); + OSMO_ASSERT(rc == 0); + + printf("\n"); +} + int main(int argc, char **argv) { struct ss_request req; @@ -237,6 +264,9 @@ /* Test gsm0480_parse_facility_ie() */ test_parse_facility_ie(); + /* Test parse_process_uss_req() against an oversized length byte */ + test_process_uss_req_overflow(); + memset(&req, 0, sizeof(req)); gsm0480_decode_ss_request((struct gsm48_hdr *) ussd_request, sizeof(ussd_request), &req); diff --git a/tests/ussd/ussd_test.ok b/tests/ussd/ussd_test.ok index 1137080..6e23da3 100644 --- a/tests/ussd/ussd_test.ok +++ b/tests/ussd/ussd_test.ok @@ -12,6 +12,8 @@ [?] Data length: expected 0x01, decoded 0x01 [?] Data: expected 32, decoded 32 +[i] Testing parse_process_uss_req() against an oversized USSD-String length + Tested if it still works. Text was: **321# interrogateSS CFU text..'' code 33 Testing parsing a USSD request and truncated versions -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43191?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I62a2ea539238d8c2dbab897ce2f80b9ab905a108 Gerrit-Change-Number: 43191 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm29205: fix out-of-bounds read in osmo_dec_gcr()
by fixeria 09 Aug '26

09 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email ) Change subject: gsm29205: fix out-of-bounds read in osmo_dec_gcr() ...................................................................... gsm29205: fix out-of-bounds read in osmo_dec_gcr() The length check at the top of the function only verified that the input buffer was at least 13 bytes, which is the minimum needed for .net_len == 3. For .net_len == 4 or 5 (also valid per the length check further down), the actual minimum required length is 10 + net_len, i.e. 14 or 15 bytes. With a shorter buffer, the subsequent osmo_load16be(), elem[] access and memcpy() read past the end of the caller-supplied buffer. elem/len are taken directly from a received BSSMAP Global Call Reference IE (gsm0808_utils.c), so this is reachable with network-supplied input. Add a length check depending on the actual .net_len, and a test. Change-Id: I6855d6c810c2b4274ccfd7bc861405f9b4e09343 Fixes: OS#7044 --- M src/gsm/gsm29205.c M tests/gsm29205/gsm29205_test.c M tests/gsm29205/gsm29205_test.ok 3 files changed, 34 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/90/43190/1 diff --git a/src/gsm/gsm29205.c b/src/gsm/gsm29205.c index 8fed020..8fe91f7 100644 --- a/src/gsm/gsm29205.c +++ b/src/gsm/gsm29205.c @@ -73,6 +73,8 @@ gcr->net_len = elem[0]; if (gcr->net_len < 3 || gcr->net_len > 5) return -EINVAL; + if (len < 10 + gcr->net_len) + return -EBADMSG; memcpy(gcr->net, elem + parsed, gcr->net_len); /* +1 for ignored Node ID length field */ diff --git a/tests/gsm29205/gsm29205_test.c b/tests/gsm29205/gsm29205_test.c index 6598f89..6bcf602 100644 --- a/tests/gsm29205/gsm29205_test.c +++ b/tests/gsm29205/gsm29205_test.c @@ -95,6 +95,33 @@ msgb_free(msg); } +/* osmo_dec_gcr() must reject buffers that are too short for the announced + * .net_len (3..5), not just shorter than the 13-byte minimum for + * .net_len == 3. Otherwise it reads past the end of 'elem'. */ +static void test_gcr_dec_short_buf(void) +{ + static const uint8_t res[] = { + 0x05, /* .net_len */ + 0x51, 0x52, 0x53, 0x54, 0x55, /* .net */ + 0x02, /* .node length */ + 0xde, 0xad, /* .node */ + 0x05, /* length of Call. Ref. */ + 0x41, 0x42, 0x43, 0x44, 0x45 /* .cr - Call. Ref. */ + }; + struct osmo_gcr_parsed p; + uint8_t len; + int rc; + + printf("Testing Global Call Reference decoder against short buffers...\n"); + + /* net_len == 5 requires 15 bytes, feed it 13 and 14 + * the full buffer must still decode successfully */ + for (len = 13; len <= ARRAY_SIZE(res); len++) { + rc = osmo_dec_gcr(&p, res, len); + printf("\tlen=%u: rc=%d\n", len, rc); + } +} + int main(int argc, char **argv) { osmo_init_logging2(talloc_named_const(NULL, 0, "gsm29205 test"), NULL); @@ -102,6 +129,7 @@ printf("Testing 3GPP TS 29.205 routines...\n"); test_gcr(); + test_gcr_dec_short_buf(); printf("Done.\n"); diff --git a/tests/gsm29205/gsm29205_test.ok b/tests/gsm29205/gsm29205_test.ok index bddd88a..d83db2e 100644 --- a/tests/gsm29205/gsm29205_test.ok +++ b/tests/gsm29205/gsm29205_test.ok @@ -2,4 +2,8 @@ Testing Global Call Reference encoder... 13 bytes added: OK decoded 13 bytes: OK +Testing Global Call Reference decoder against short buffers... + len=13: rc=-74 + len=14: rc=-74 + len=15: rc=15 Done. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I6855d6c810c2b4274ccfd7bc861405f9b4e09343 Gerrit-Change-Number: 43190 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gb: fix buffer overflow in bssgp_rx_paging()
by fixeria 09 Aug '26

09 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email ) Change subject: gb: fix buffer overflow in bssgp_rx_paging() ...................................................................... gb: fix buffer overflow in bssgp_rx_paging() gsm48_parse_ra() was called against a local 6-byte buffer that was first memcpy()'d from TLVP_VAL() using the IE's own TLVP_LEN(), which can exceed 6 bytes for BSSGP_IE_LOCATION_AREA (5 bytes expected) and BSSGP_IE_ROUTEING_AREA (6 bytes expected) when a peer sends a larger IE, overflowing ra[]. Drop the intermediate copy and pass the TLV pointer directly to gsm48_parse_ra(), which only reads the bytes it needs. Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Fixes: OS#7043 --- M src/gb/gprs_bssgp_bss.c 1 file changed, 2 insertions(+), 9 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/89/43189/1 diff --git a/src/gb/gprs_bssgp_bss.c b/src/gb/gprs_bssgp_bss.c index 8230d87..dbb1e4b 100644 --- a/src/gb/gprs_bssgp_bss.c +++ b/src/gb/gprs_bssgp_bss.c @@ -479,11 +479,8 @@ struct bssgp_normal_hdr *bgph = (struct bssgp_normal_hdr *) msgb_bssgph(msg); struct tlv_parsed tp; - uint8_t ra[6]; int rc, data_len; - memset(ra, 0, sizeof(ra)); - data_len = msgb_bssgp_len(msg) - sizeof(*bgph); rc = bssgp_tlv_parse(&tp, bgph->data, data_len); if (rc < 0) @@ -519,14 +516,10 @@ pinfo->scope = BSSGP_PAGING_BSS_AREA; } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_LOCATION_AREA, 5)) { pinfo->scope = BSSGP_PAGING_LOCATION_AREA; - memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA), - TLVP_LEN(&tp, BSSGP_IE_LOCATION_AREA)); - gsm48_parse_ra(&pinfo->raid, ra); + gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA)); } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_ROUTEING_AREA, 6)) { pinfo->scope = BSSGP_PAGING_ROUTEING_AREA; - memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA), - TLVP_LEN(&tp, BSSGP_IE_ROUTEING_AREA)); - gsm48_parse_ra(&pinfo->raid, ra); + gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA)); } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_BVCI, 2)) { pinfo->scope = BSSGP_PAGING_BVCI; pinfo->bvci = tlvp_val16be(&tp, BSSGP_IE_BVCI); -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Gerrit-Change-Number: 43189 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: TCAP: Refactoring unroutable messages into own function
by lynxis lazus 08 Aug '26

08 Aug '26

Attention is currently required from: daniel, laforge, pespin. lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007?usp=email ) Change subject: TCAP: Refactoring unroutable messages into own function ...................................................................... Patch Set 2: (4 comments) File src/tcap_as_loadshare.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007/comment/87db6544_c09cc… : PS2, Line 458: the message will be paths. > what do you mean by "the message will be paths"? I don't understand what this is supposed to say. Done https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007/comment/445464c7_6fc8e… : PS2, Line 466: static int asp_loadshare_tcap_unroutable(struct osmo_ss7_asp **rasp, > asp_loadshare_tcap_unroutable_fallback() may be more descriptive. […] fallback will be used by the DPC routing. I've renamed it to asp_loadshare_tcap_handle_unroutable https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007/comment/c03bd5cf_e5413… : PS2, Line 608: rate_ctr_inc2(as->ctrg, SS7_AS_CTR_TCAP_ASP_FALLBACK); > AFAIU this patch could be reduce to only adding the following line here: […] no, because you also have to set the rc code. In general this function needs to be refactored. it is far to long and complex. I've refactored some of the parts. But still this function would need a refactoring https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007/comment/9aa931d1_c8ed9… : PS2, Line 636: rate_ctr_inc2(as->ctrg, SS7_AS_CTR_TCAP_ASP_FALLBACK); > AFAIU this patch could be reduce to only adding the following line here: […] see above. -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ib4d114273423730418458767d17b11de9bd815d4 Gerrit-Change-Number: 43007 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Comment-Date: Sat, 08 Aug 2026 12:33:48 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026