August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by dexter 13 Aug '26

13 Aug '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... sgs_iface: guard against over-long MME name IEs. The function decode_mme_name decodes the MME name from the given tlv_parsed struct a buffer referenced by mme_name. Since the maximum length of the MME name is fixed, the length of the output buffer is also fixed (SGS_MME_NAME_LEN bytes + 1 byte string terminator). Unfortunately the function does not guard against over-long input. When the SGSAP_IE_MME_NAME IE is longer than SGS_MME_NAME_LEN, then either memcpy or osmo_apn_to_str may overflow the output buffer. Bug reported by: adam.bedard(a)gmail.com Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Related: OS#7058 --- M src/libmsc/sgs_iface.c 1 file changed, 4 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/29/43229/1 diff --git a/src/libmsc/sgs_iface.c b/src/libmsc/sgs_iface.c index 178aa64..ddd96b9 100644 --- a/src/libmsc/sgs_iface.c +++ b/src/libmsc/sgs_iface.c @@ -168,6 +168,10 @@ if (!mme_name_enc) return -EINVAL; + /* do not accept IEs which exceed SGS_MME_NAME_LEN */ + if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > SGS_MME_NAME_LEN) + return -EINVAL; + /* some implementations use FDQN format violating TS 29.118 9.3.14 */ if (!osmo_parse_mme_domain(&gummei, (const char *) mme_name_enc)) { memcpy(mme_name, mme_name_enc, TLVP_LEN(tp, SGSAP_IE_MME_NAME)); -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: xUA: Handle rx multiple Routing Context in SNM messages
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: laforge. pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43226?usp=email ) Change subject: xUA: Handle rx multiple Routing Context in SNM messages ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: > yes, please. […] https://osmocom.org/issues/7062 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43226?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9ef1e343e95961d497f55e4a512068d3e7585a0c Gerrit-Change-Number: 43226 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Thu, 13 Aug 2026 15:23:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email ) Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... Patch Set 2: Code-Review+1 (1 comment) Patchset: PS2: I wouldn't even dare to parse the stuff if we are returning an error anyway, but ok. -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 15:22:24 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmocore[master]: Add missing length check in gsm48_decode_callerid()
by laforge 13 Aug '26

13 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43227?usp=email ) Change subject: Add missing length check in gsm48_decode_callerid() ...................................................................... Add missing length check in gsm48_decode_callerid() Check if octet 3a is present in case it is expected. It is expected, if the extension flag is set in octet 3. Related: OS#7055 Change-Id: If40e318c24048a3727fa20684af32a8106f97f4a --- M src/gsm/gsm48_ie.c 1 file changed, 2 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, approved diff --git a/src/gsm/gsm48_ie.c b/src/gsm/gsm48_ie.c index 7a41ae8..e33e672 100644 --- a/src/gsm/gsm48_ie.c +++ b/src/gsm/gsm48_ie.c @@ -491,6 +491,8 @@ /* octet 3a */ if (!(lv[1] & 0x80)) { + if (in_len < 2) + return -EINVAL; callerid->screen = lv[2] & 0x03; callerid->present = (lv[2] & 0x60) >> 5; i = 2; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43227?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: If40e318c24048a3727fa20684af32a8106f97f4a Gerrit-Change-Number: 43227 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, pespin. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email ) Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 15:21:56 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by fixeria 13 Aug '26

13 Aug '26

Attention is currently required from: laforge, pespin. fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email ) Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... Patch Set 1: (2 comments) Patchset: PS1: > I think it would be prudent to give credit to the reporter of the bug in the commitlog. Done File src/sua.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228/comment/f801c734_65c51… : PS1, Line 403: /* cap num_digits to what fits into gt->digits (leaving room for '\0') */ > why silently clamping instead of returning an error? Acknowledged -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 15:15:47 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by fixeria 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, laforge. Hello Jenkins Builder, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by laforge, Verified+1 by Jenkins Builder Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... sua: fix buffer overflow in sua_parse_gt() RFC 3868 does not impose a limit on the Number of Digits, so ideally we should be able to parse up to 255 digits. However, our gt->digits[] can only fit up to 31 digits + a terminating NUL. Cap num_digits to the size of gt->digits before decoding and parse as much as we can, returning -ENOSPC if not all digits fit. Add a unit test covering both the exact-fit and oversized num_digits cases. Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Reported-By: 3ntr0py1337 Fixes: OS#7046 --- M src/sua.c M tests/xua/xua_test.c M tests/xua/xua_test.ok 3 files changed, 42 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/28/43228/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: xUA: Handle rx multiple Routing Context in SNM messages
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43226?usp=email ) Change subject: xUA: Handle rx multiple Routing Context in SNM messages ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: > Not yet specific tests for multi AS in SNM messages afaict. […] yes, please. I'm tempted to hold back on this patch for a low-priority feature until tests appear :/ -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43226?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9ef1e343e95961d497f55e4a512068d3e7585a0c Gerrit-Change-Number: 43226 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:41:31 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: xUA: Handle rx multiple Routing Context in SNM messages
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: laforge. pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43226?usp=email ) Change subject: xUA: Handle rx multiple Routing Context in SNM messages ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: > do we have any test coverage for this in the TTCN-3 test suite or otherwise? It seems like the lind […] Not yet specific tests for multi AS in SNM messages afaict. In any case I run the full stp testsuite and it looks good, so at least usual tests cases we are used to are still fine. I agree we want to add tests for this, I can create a ticket to track it if you want. -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43226?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9ef1e343e95961d497f55e4a512068d3e7585a0c Gerrit-Change-Number: 43226 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:29:53 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email ) Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... Patch Set 1: (1 comment) File src/sua.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228/comment/94080ead_8e913… : PS1, Line 403: /* cap num_digits to what fits into gt->digits (leaving room for '\0') */ why silently clamping instead of returning an error? -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:28:00 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0