August 2026 - gerrit-log - lists.osmocom.org

[S] Change in osmo-hlr[master]: mslookup: fix size_t underflow in mDNS decode
by n0k0 08 Aug '26

08 Aug '26

Attention is currently required from: fixeria, n0k0. Hello Jenkins Builder, fixeria, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email to look at the new patch set (#4). The following approvals got outdated and were removed: Code-Review+1 by fixeria, Verified+1 by Jenkins Builder Change subject: mslookup: fix size_t underflow in mDNS decode ...................................................................... mslookup: fix size_t underflow in mDNS decode osmo_mdns_rfc_record_decode() computes the strnlen() scan bound as 'data_len - 10' where data_len is a size_t. osmo_mdns_msg_answer_decode() loops "while (data_len)" with no minimum-length guard, so it can call record_decode() with data_len in 1..9. 'data_len - 10' then underflows to ~SIZE_MAX and strnlen() scans far past the receive buffer until it finds a NUL, and data[name_len] reads further still, before the trailing "name_len + 10 + rdlength > data_len" check ever runs. A record must contain at least one name byte plus the 10 fixed trailing bytes (type, class, ttl, rdlength); reject anything shorter so the subtraction cannot underflow. Additionally, an unterminated name still let the fixed-field loads read one byte past the buffer: strnlen() can return its bound, making name_len equal to data_len - 9, so osmo_load16be(data + name_len + 8) touched data[data_len] before the trailing length check ran. Require room for the name plus the 10 fixed trailing bytes before reading any of them. Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 --- M src/mslookup/mdns_rfc.c 1 file changed, 13 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-hlr refs/changes/88/42888/4 -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 Gerrit-Change-Number: 42888 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by n0k0 08 Aug '26

08 Aug '26

Attention is currently required from: fixeria, n0k0, pespin. Hello fixeria, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email to look at the new patch set (#4). The following approvals got outdated and were removed: Code-Review+1 by pespin, Code-Review+2 by fixeria Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... ipaccess-proxy: reject oversized IPA frame length ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the wire header and passes it straight as the recv() count into a msgb that was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever checking it against the buffer tailroom. A peer that advertises a body length larger than the remaining buffer space makes recv() write past the end of the heap allocation (heap buffer overflow). Reject frames whose advertised length exceeds the msgb tailroom, the same way the other IPA read paths bound the read to msgb_tailroom(). Also reject a short (split) IPA header: recv() of the 3-byte header can return fewer than 3 bytes on a stream socket, which left msg->l2h ahead of msg->tail while the length was validated against msgb_tailroom() (measured from msg->tail), so a 1-2 byte body overflow was still possible. Bail out on a short header, as the other IPA read paths do. This issue has been assigned the CVE candidate identifier CAN-2026-2051036. Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 16 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/86/42886/4 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in onomondo-eim[master]: esipa_rest_utils: add support for PSMOs added in SGP.32 V.1.2
by fixeria 08 Aug '26

08 Aug '26

Attention is currently required from: dexter, jolly. fixeria has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/42881?usp=email ) Change subject: esipa_rest_utils: add support for PSMOs added in SGP.32 V.1.2 ...................................................................... Patch Set 9: (1 comment) File contrib/rest_api_resource_schema.json: https://gerrit.osmocom.org/c/onomondo-eim/+/42881/comment/b8ef3d08_1f192b9a… : PS9, Line 169: , > Are you sure? I always thought the ',' is a delimiter. I used SGP.32, section 6.4.1. as an example. […] @andreas@eversberg.eu is right here. `[0-9,A-F]` literally matches digits, uppercase letters, and the coma character. You can check/debug regular expressions here: https://regex101.com/. -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/42881?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I03cdd70065a83dfc611d614cf32d817c13fad347 Gerrit-Change-Number: 42881 Gerrit-PatchSet: 9 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: jolly <andreas(a)eversberg.eu> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 16:15:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: jolly <andreas(a)eversberg.eu> Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in osmo-hlr[master]: mslookup: fix size_t underflow in mDNS decode
by fixeria 08 Aug '26

08 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email ) Change subject: mslookup: fix size_t underflow in mDNS decode ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 Gerrit-Change-Number: 42888 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 16:03:30 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libasn1c[master]: constr_CHOICE: fix always-true bounds check
by fixeria 08 Aug '26

08 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email ) Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 16:02:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in onomondo-ipa[master]: V1.2: Add function ES10b.DisableEmergencyProfile
by dexter 08 Aug '26

08 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/onomondo-ipa/+/43044?usp=email ) Change subject: V1.2: Add function ES10b.DisableEmergencyProfile ...................................................................... Patch Set 3: Code-Review+1 (3 comments) File include/onomondo/ipa/ipad.h: https://gerrit.osmocom.org/c/onomondo-ipa/+/43044/comment/152d9447_f5c1ce33… : PS3, Line 100: int ipa_disable_emergency_profile(struct ipa_context *ctx); maybe shorten "profile" to "prfle" and "emergency" to "emerg"? File src/ipa/libipa/es10b_dis_emerg_prfle.h: https://gerrit.osmocom.org/c/onomondo-ipa/+/43044/comment/ee9fba39_2eeedfbf… : PS3, Line 14: struct DisableEmergencyProfileResponse *res; Also here, maybe just return the integer result? File src/ipa/main.c: https://gerrit.osmocom.org/c/onomondo-ipa/+/43044/comment/3c407d0d_264c228f… : PS3, Line 56: printf(" --disable-emergency-profile. Trigger return from emergency profile to previous profile\n"); > see my comment on an earlier patch of this series about options that are […] Acknowledged -- To view, visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43044?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-ipa Gerrit-Branch: master Gerrit-Change-Id: I2af2077228fb8c5fa3f254acc15bd0afaa33fe43 Gerrit-Change-Number: 43044 Gerrit-PatchSet: 3 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Fri, 07 Aug 2026 15:58:42 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[S] Change in osmo-iuh[master]: iu_client: reject oversized RANAP NAS-PDU
by fixeria 08 Aug '26

08 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email ) Change subject: iu_client: reject oversized RANAP NAS-PDU ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I7dbce926477f9842cd466d46cda836638f04011f Gerrit-Change-Number: 42887 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 15:57:46 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libsmpp34[master]: smpp34_unpack: bound C_OCTET scan with strnlen()
by fixeria 08 Aug '26

08 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email ) Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libsmpp34 Gerrit-Branch: master Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 Gerrit-Change-Number: 42889 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 15:56:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by fixeria 08 Aug '26

08 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 15:53:09 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in onomondo-ipa[master]: V1.2: Add function ES10b.EnableEmergencyProfile
by dexter 08 Aug '26

08 Aug '26

Attention is currently required from: jolly, laforge. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/onomondo-ipa/+/43043?usp=email ) Change subject: V1.2: Add function ES10b.EnableEmergencyProfile ...................................................................... Patch Set 3: Code-Review+1 (3 comments) File include/onomondo/ipa/ipad.h: https://gerrit.osmocom.org/c/onomondo-ipa/+/43043/comment/cccb1cba_04d54c4b… : PS3, Line 99: int ipa_enable_emergency_profile(struct ipa_context *ctx); you can shorten "profile" to "prfle", we used this abbreviation in lots of other places too. File src/ipa/libipa/es10b_en_emerg_prfle.h: https://gerrit.osmocom.org/c/onomondo-ipa/+/43043/comment/db204658_4793ada0… : PS3, Line 14: struct EnableEmergencyProfileResponse *res; Also here, it is just an integer that is returned, maybe return it directly to get an API that is simpler to use? File src/ipa/main.c: https://gerrit.osmocom.org/c/onomondo-ipa/+/43043/comment/39d88b30_0e485d3f… : PS3, Line 179: { "enable-emergency-profile", no_argument, NULL, OPT_ENABLEEMGERGENCY}, See comment from @laforge@gnumonks.org in the previous patch. I think we should clean this up. -- To view, visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43043?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-ipa Gerrit-Branch: master Gerrit-Change-Id: I0304b869a14a36b82cc2d1676b2a5f613e1da171 Gerrit-Change-Number: 43043 Gerrit-PatchSet: 3 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-CC: laforge <laforge(a)gnumonks.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: laforge <laforge(a)gnumonks.org> Gerrit-Comment-Date: Fri, 07 Aug 2026 15:51:02 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026