Attention is currently required from: pespin.
Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email
to look at the new patch set (#3).
The following approvals got outdated and were removed:
Verified+1 by Jenkins Builder
Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
......................................................................
sccp2sua: fix buffer overrun in osmo_isup_party_parse()
Add an out_digits_size parameter and check that the caller-provided
buffer is large enough to hold the generated digits plus the
terminating NUL, instead of blindly writing up to 2 * in_num_bytes
characters into it.
Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8
Fixes: OS#7038
---
M src/sccp2sua.c
M src/xua_internal.h
M tests/xua/xua_test.c
M tests/xua/xua_test.ok
4 files changed, 37 insertions(+), 8 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/63/43163/3
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8
Gerrit-Change-Number: 43163
Gerrit-PatchSet: 3
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Attention is currently required from: pespin.
fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email )
Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
......................................................................
Patch Set 2:
(1 comment)
File src/sccp2sua.c:
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163/comment/0982b8f9_420cc… :
PS1, Line 74: if (in_num_bytes * 2 >= out_digits_size)
> Note that the check is using `>=`, i.e. […]
Ah, I guess I know what you mean. The output buffer is `digits[32]`, so we can accept up to 31 BCD-digits + `'\0'`. If the input is `in_num_bytes=32` and `odd=true` (i.e. the input contains 31 BCD-digits), we'll reject it for no good reason. I'll rework the patch.
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8
Gerrit-Change-Number: 43163
Gerrit-PatchSet: 2
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Tue, 04 Aug 2026 14:39:25 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: fixeria <vyanitskiy(a)sysmocom.de>
Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>
Attention is currently required from: pespin.
fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email )
Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
......................................................................
Patch Set 2:
(1 comment)
File src/sccp2sua.c:
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163/comment/48f47869_f1535… :
PS1, Line 74: if (in_num_bytes * 2 >= out_digits_size)
> shouldn't you account for one extra byte in this check in the case it's even number of bytes? becaus […]
Note that the check is using `>=`, i.e. we accept the input only when `out_digits_size > in_num_bytes * 2`. Equivalent to `(in_num_bytes * 2 + 1) > out_digits_size`. Am I missing something here?
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8
Gerrit-Change-Number: 43163
Gerrit-PatchSet: 2
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Tue, 04 Aug 2026 14:32:10 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>
Attention is currently required from: fixeria.
pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email )
Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
......................................................................
Patch Set 1:
(1 comment)
File src/sccp2sua.c:
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163/comment/135e4dcb_8f836… :
PS1, Line 74: if (in_num_bytes * 2 >= out_digits_size)
shouldn't you account for one extra byte in this check in the case it's even number of bytes? because then you need one extra digit anyway.
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8
Gerrit-Change-Number: 43163
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Comment-Date: Tue, 04 Aug 2026 14:13:40 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Attention is currently required from: fixeria.
Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Verified-1 by Jenkins Builder
Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
......................................................................
sccp2sua: fix buffer overrun in osmo_isup_party_parse()
Add an out_digits_size parameter and check that the caller-provided
buffer is large enough to hold the generated digits plus the
terminating NUL, instead of blindly writing up to 2 * in_num_bytes
characters into it.
Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8
Fixes: OS#7038
---
M src/sccp2sua.c
M src/xua_internal.h
M tests/xua/xua_test.c
3 files changed, 17 insertions(+), 8 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/63/43163/2
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8
Gerrit-Change-Number: 43163
Gerrit-PatchSet: 2
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>