August 2026 - gerrit-log - lists.osmocom.org

[M] Change in pysim[master]: osmo-smdpp: derive the Profile Metadata from the Profile
by jwaigel 13 Aug '26

13 Aug '26

Attention is currently required from: dexter, jolly, laforge. jwaigel has posted comments on this change by jwaigel. ( https://gerrit.osmocom.org/c/pysim/+/43205?usp=email ) Change subject: osmo-smdpp: derive the Profile Metadata from the Profile ...................................................................... Patch Set 3: (1 comment) File osmo-smdpp.py: https://gerrit.osmocom.org/c/pysim/+/43205/comment/dbce66ab_0d7ee0eb?usp=em… : PS2, Line 638: # look up profile based on matchingID. We simply check if a given file exists for now.. > I don't like that the 'if matchingId' (or alternatively an 'else' clause) has been removed here. […] Restored the second branch, thanks. -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43205?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ie24dd5ac0ef541c1899dd923a9db568209bbfa62 Gerrit-Change-Number: 43205 Gerrit-PatchSet: 3 Gerrit-Owner: jwaigel <johannes(a)waigel.me> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:14:34 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
by osmith 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email ) Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:10:17 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by fixeria 13 Aug '26

13 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email ) Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... sua: fix buffer overflow in sua_parse_gt() Cap num_digits to the size of gt->digits before decoding. Add a unit test covering both the exact-fit and oversized num_digits cases. Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Fixes: OS#7046 --- M src/sua.c M tests/xua/xua_test.c M tests/xua/xua_test.ok 3 files changed, 34 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/28/43228/1 diff --git a/src/sua.c b/src/sua.c index b169d50..50fe030 100644 --- a/src/sua.c +++ b/src/sua.c @@ -400,6 +400,10 @@ gt->npi = data[6]; gt->nai = data[7]; + /* cap num_digits to what fits into gt->digits (leaving room for '\0') */ + if (num_digits > sizeof(gt->digits) - 1) + num_digits = sizeof(gt->digits) - 1; + /* parse digits */ out_digits = gt->digits; for (i = 0; i < datalen-8; i++) { diff --git a/tests/xua/xua_test.c b/tests/xua/xua_test.c index 3c5f5fd..ac044be 100644 --- a/tests/xua/xua_test.c +++ b/tests/xua/xua_test.c @@ -372,6 +372,31 @@ msgb_free(msg); } +static void test_sua_parse_gt_overflow(void) +{ + /* 8-byte header + way more digit octets than fit into gt->digits[32] */ + uint8_t data[8 + 64]; + struct osmo_sccp_gt gt = {}; + + memset(data, 0x11, sizeof(data)); + data[3] = 0x42; /* gti */ + data[5] = 0x00; /* tt */ + data[6] = 0x01; /* npi */ + data[7] = 0x04; /* nai */ + + data[4] = sizeof(gt.digits); /* num_digits: not enough room for '\0' */ + printf("Testing sua_parse_gt() with num_digits=%u\n", data[4]); + OSMO_ASSERT(sua_parse_gt(&gt, data, sizeof(data)) == 0); + OSMO_ASSERT(strlen(gt.digits) == sizeof(gt.digits) - 1); + printf("OUT:%s\n", osmo_sccp_gt_dump(&gt)); + + data[4] = 0xff; /* num_digits: attacker-controlled, way too large */ + printf("Testing sua_parse_gt() with oversized num_digits\n"); + OSMO_ASSERT(sua_parse_gt(&gt, data, sizeof(data)) == 0); + OSMO_ASSERT(strlen(gt.digits) == sizeof(gt.digits) - 1); + printf("OUT:%s\n", osmo_sccp_gt_dump(&gt)); +} + /* SCCP Message Transcoding */ struct sccp2sua_testcase { @@ -679,6 +704,7 @@ test_isup_parse(); test_sccp_addr_parser(); test_helpers(); + test_sua_parse_gt_overflow(); test_sccp2sua(); test_rkm(); test_sccp_addr_encdec(); diff --git a/tests/xua/xua_test.ok b/tests/xua/xua_test.ok index 02e5f49..d4a70b1 100644 --- a/tests/xua/xua_test.ok +++ b/tests/xua/xua_test.ok @@ -16,6 +16,10 @@ 0400000001000000040000003931393936393637393338390000000000000000000000000000000000000000 OUT:TT=0,NPL=1,NAI=4,DIG=919969679389 0400000001000000040000003931393936393637393338390000000000000000000000000000000000000000 +Testing sua_parse_gt() with num_digits=32 +OUT:DIG=1111111111111111111111111111111 +Testing sua_parse_gt() with oversized num_digits +OUT:DIG=1111111111111111111111111111111 => BSSMAP-RESET SCCP Input: [L2]> 09 00 03 05 07 02 42 fe 02 42 fe 06 00 04 30 04 01 20 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: xua: Avoid OOB read of Routing Context with len < 4
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43222?usp=email ) Change subject: xua: Avoid OOB read of Routing Context with len < 4 ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43222?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: If19f210c8d6a308f99b4f06fdc06581ffdc62696 Gerrit-Change-Number: 43222 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:04:57 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_not...
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email ) Change subject: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify() ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751 Gerrit-Change-Number: 43221 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:04:52 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: sua: Dispatch M-NOTIFY.ind to ASP
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43219?usp=email ) Change subject: sua: Dispatch M-NOTIFY.ind to ASP ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43219?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I62255aea1448bb76181b5f6799c3b9bf8c7daa79 Gerrit-Change-Number: 43219 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:04:21 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: xUA: Avoid sending M-NOTIFY.ind with garbage if decoding xUA NOTIFY f...
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43220?usp=email ) Change subject: xUA: Avoid sending M-NOTIFY.ind with garbage if decoding xUA NOTIFY fails ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43220?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59e67f03fab6fbf8aa50f44bd1d4165dcd7c8b2f Gerrit-Change-Number: 43220 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:04:16 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, osmith, pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email ) Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... Patch Set 2: Code-Review+1 (1 comment) Patchset: PS1: > The fix is different than the one proposed. I added a Reported-By: tag to the commit. Done -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:00:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, laforge, osmith. pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email ) Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... Patch Set 2: (1 comment) Patchset: PS1: > Bug reporter shoukd geht credit. If its his fix, git author should reflect it. […] The fix is different than the one proposed. I added a Reported-By: tag to the commit. -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 13:57:08 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, laforge, osmith, pespin. Hello Jenkins Builder, fixeria, laforge, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review+1 by osmith Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... m3ua: Fix potential OOB read in rx NOTIFY INFO String IE Despite RFC4666 states it can contain "any meaningful UTF-8 character string", it also states that the string can be 0 bytes, which implicitly means a string could come without null char at the end. In any case, it's good practice to guard against it, as already done in all the other libosmo-sigtran code. Related: OS#7056 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 --- M src/m3ua.c 1 file changed, 3 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/16/43216/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0