August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in libosmo-sigtran[master]: xua_snm.c: Use M3UA IE define when shared with SUA IE
by pespin 13 Aug '26

13 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43217?usp=email ) Change subject: xua_snm.c: Use M3UA IE define when shared with SUA IE ...................................................................... xua_snm.c: Use M3UA IE define when shared with SUA IE We use everywhere the M3UA IE define when both the M3UA and SUA IE are equivalent (for those IEs the SUA define points to the M3UA, and osmo_static_assert() are placed at the start of the file). Change-Id: Ie15e5a179b65afc7a0d1cbe145cce4cf2556c877 --- M src/xua_snm.c 1 file changed, 2 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/17/43217/1 diff --git a/src/xua_snm.c b/src/xua_snm.c index a2e4fde..2abc42e 100644 --- a/src/xua_snm.c +++ b/src/xua_snm.c @@ -552,8 +552,8 @@ /* an incoming SUA/M3UA DUPU was received from a remote SG */ void xua_snm_rx_dupu(struct osmo_ss7_asp *asp, struct osmo_ss7_as *as, struct xua_msg *xua) { - uint32_t aff_pc = xua_msg_get_u32(xua, SUA_IEI_AFFECTED_PC); - const char *info_str = xua_msg_get_str(xua, SUA_IEI_INFO_STRING); + uint32_t aff_pc = xua_msg_get_u32(xua, M3UA_IEI_AFFECTED_PC); + const char *info_str = xua_msg_get_str(xua, M3UA_IEI_INFO_STRING); /* TODO: should our processing depend on the RCTX included? I somehow don't think so */ //struct xua_msg_part *ie_rctx = xua_msg_find_tag(xua, SUA_IEI_ROUTE_CTX); int log_ss = osmo_ss7_asp_get_log_subsys(asp); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43217?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ie15e5a179b65afc7a0d1cbe145cce4cf2556c877 Gerrit-Change-Number: 43217 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: sua: Dispatch M-NOTIFY.ind to ASP
by pespin 13 Aug '26

13 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43219?usp=email ) Change subject: sua: Dispatch M-NOTIFY.ind to ASP ...................................................................... sua: Dispatch M-NOTIFY.ind to ASP This was already done in M3UA counterpart m3ua_rx_mgmt_ntfy(), but was missing in the SUA one. Change-Id: I62255aea1448bb76181b5f6799c3b9bf8c7daa79 --- M src/sua.c 1 file changed, 7 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/19/43219/1 diff --git a/src/sua.c b/src/sua.c index 3b54c22..572e77b 100644 --- a/src/sua.c +++ b/src/sua.c @@ -34,7 +34,6 @@ #include <osmocom/core/fsm.h> #include <osmocom/netif/stream.h> -#include "xua_msg.h" #include <osmocom/sigtran/sccp_sap.h> #include <osmocom/sigtran/protocol/mtp.h> @@ -50,6 +49,8 @@ #include "ss7_as.h" #include "ss7_asp.h" #include "ss7_internal.h" +#include "xua_msg.h" +#include "xua_lm_sap.h" /* Appendix C.4 of Q.714 (all in milliseconds) */ #define CONNECTION_TIMER ( 1 * 60 * 100) @@ -653,6 +654,7 @@ { struct osmo_xlm_prim_notify ntfy; const char *type_name, *info_name; + struct osmo_xlm_prim *prim; m3ua_decode_notify(&ntfy, asp, xua); @@ -662,10 +664,13 @@ type_name, info_name, ntfy.info_string ? ntfy.info_string : ""); + /* report this to layer manager */ + prim = xua_xlm_prim_alloc_m_notify_ind(&ntfy); + xua_asp_send_xlm_prim(asp, prim); + if (ntfy.info_string) talloc_free(ntfy.info_string); - /* TODO: should we report this somewhere? */ return 0; } -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43219?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I62255aea1448bb76181b5f6799c3b9bf8c7daa79 Gerrit-Change-Number: 43219 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_not...
by pespin 13 Aug '26

13 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email ) Change subject: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify() ...................................................................... m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify() In theory user should have a look at npar->presence before accessing those fields, but in case it is somewhere forgotten then best having some initialized values, specially in the route_ctx_count which could turn into buffer overflows or reading more garbage from uninitialized array members. Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751 --- M src/m3ua.c 1 file changed, 4 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/21/43221/1 diff --git a/src/m3ua.c b/src/m3ua.c index 39402fd..f2455eb 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -484,6 +484,8 @@ if (aspid_ie) { npar->asp_id = xua_msg_part_get_u32(aspid_ie); npar->presence |= NOTIFY_PAR_P_ASP_ID; + } else { + npar->asp_id = 0; } if (rctx_ie) { @@ -502,6 +504,8 @@ for (unsigned int i = 0; i < npar->route_ctx_count; i++) npar->route_ctx[i] = ntohl(*(uint32_t *)&rctx_ie->dat[i << 2]); npar->presence |= NOTIFY_PAR_P_ROUTE_CTX; + } else { + npar->route_ctx_count = 0; } if (info_ie) -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751 Gerrit-Change-Number: 43221 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: xUA: Avoid sending M-NOTIFY.ind with garbage if decoding xUA NOTIFY f...
by pespin 13 Aug '26

13 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43220?usp=email ) Change subject: xUA: Avoid sending M-NOTIFY.ind with garbage if decoding xUA NOTIFY fails ...................................................................... xUA: Avoid sending M-NOTIFY.ind with garbage if decoding xUA NOTIFY fails Change-Id: I59e67f03fab6fbf8aa50f44bd1d4165dcd7c8b2f --- M src/m3ua.c M src/sua.c 2 files changed, 17 insertions(+), 6 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/20/43220/1 diff --git a/src/m3ua.c b/src/m3ua.c index 69b4438..39402fd 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -453,7 +453,12 @@ return xua; } -/* RFC4666 Ch. 3.8.2. Notify */ +/*! \brief RFC4666 Ch. 3.8.2. Notify. + * \param[in] npar Primitive to fill + * \param[in] ctx talloc context where a decoded INFO String may be allocated + * \param[in] xua xUA message to be decoded + * \return 0 on success; positive xUA error code otherwise + */ int m3ua_decode_notify(struct osmo_xlm_prim_notify *npar, void *ctx, const struct xua_msg *xua) { @@ -464,7 +469,7 @@ status_ie = xua_msg_find_tag(xua, M3UA_IEI_STATUS); if (!status_ie) { LOGP(DLM3UA, LOGL_ERROR, "M3UA NOTIFY without Status IE\n"); - return -1; + return M3UA_ERR_MISSING_PARAM; } status = *(uint32_t *) status_ie->dat; @@ -485,13 +490,13 @@ if (rctx_ie->len & 0x03) { LOGP(DLM3UA, LOGL_ERROR, "M3UA NOTIFY with Routing Context IE length non-multiple of 4!\n"); - return -1; + return M3UA_ERR_PARAM_FIELD_ERR; } if (rctx_ie->len > sizeof(npar->route_ctx)) { LOGP(DLM3UA, LOGL_ERROR, "M3UA NOTIFY with Routing Context IE containing > %zu items not supported!\n", ARRAY_SIZE(npar->route_ctx)); - return -1; + return M3UA_ERR_UNEXP_PARAM; } npar->route_ctx_count = rctx_ie->len >> 2; for (unsigned int i = 0; i < npar->route_ctx_count; i++) @@ -711,8 +716,11 @@ struct osmo_xlm_prim_notify ntfy; const char *type_name, *info_name; struct osmo_xlm_prim *prim; + int rc; - m3ua_decode_notify(&ntfy, asp, xua); + rc = m3ua_decode_notify(&ntfy, asp, xua); + if (rc != 0) + return rc; type_name = get_value_string(m3ua_ntfy_type_names, ntfy.status_type); info_name = m3ua_ntfy_info_name(ntfy.status_type, ntfy.status_info); diff --git a/src/sua.c b/src/sua.c index 572e77b..f5dcd66 100644 --- a/src/sua.c +++ b/src/sua.c @@ -655,8 +655,11 @@ struct osmo_xlm_prim_notify ntfy; const char *type_name, *info_name; struct osmo_xlm_prim *prim; + int rc; - m3ua_decode_notify(&ntfy, asp, xua); + rc = m3ua_decode_notify(&ntfy, asp, xua); + if (rc != 0) + return rc; type_name = get_value_string(m3ua_ntfy_type_names, ntfy.status_type); info_name = m3ua_ntfy_info_name(ntfy.status_type, ntfy.status_info); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43220?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59e67f03fab6fbf8aa50f44bd1d4165dcd7c8b2f Gerrit-Change-Number: 43220 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in osmo-ttcn3-hacks[master]: 5gc: keep NUS after UeContextRelease
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: laforge. pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email ) Change subject: 5gc: keep NUS after UeContextRelease ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: > I know too little details about the 5GC test suite, but if you are convinced this is the way to go, […] Changing all that now is quite some work though, so for now I think let's merge this patch to overcome the limitations and have the tests passing again, and I'll give it a deeper look later on when I come back to this. -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 Gerrit-Change-Number: 43214 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-CC: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Thu, 13 Aug 2026 08:50:48 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in osmo-ttcn3-hacks[master]: 5gc: keep NUS after UeContextRelease
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email ) Change subject: 5gc: keep NUS after UeContextRelease ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: > TBH the more I work with the NGAP/S1AP Emulation the more I see stuffing the NAS enc/dec in there wa […] I know too little details about the 5GC test suite, but if you are convinced this is the way to go, I trust you. -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 Gerrit-Change-Number: 43214 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-CC: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 08:29:28 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-ttcn3-hacks[master]: 5gc: Fix NG NAS ul_count not incremented
by pespin 13 Aug '26

13 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email ) Change subject: 5gc: Fix NG NAS ul_count not incremented ...................................................................... 5gc: Fix NG NAS ul_count not incremented Since open5gs.git b9823196b5de3394b7a144569f186d7d62fad6f9, open5gs properly validates received seq_nr (ul_count) of integrity protected NG-NAS message to make sure it increases with each new UL message, in order to protect against accepting replayed messages. This made the 5gc testsuite fail since our NGAP/NG-NAS emulation was not properly increasing ul_count when sending new messages, but always using ul_count=0. Change-Id: I7ea4460c902a5f612243e155a484acc89acd447f --- M library/NG_CryptoFunctions.ttcn 1 file changed, 10 insertions(+), 6 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, approved laforge: Looks good to me, but someone else must approve diff --git a/library/NG_CryptoFunctions.ttcn b/library/NG_CryptoFunctions.ttcn index b16029e..840ed91 100644 --- a/library/NG_CryptoFunctions.ttcn +++ b/library/NG_CryptoFunctions.ttcn @@ -307,13 +307,16 @@ var BIT4 sec_hdr_t; var OCT4 mac; var NG_NAS_UL_Message_Type nas_out; - - if (nus.use_enc == false and nus.use_int == false) { - return nas_in; - } + var OCT1 seq_nr; if (nus.new_ctx) { nus.tx_count := 0; + } else { + nus.tx_count := nus.tx_count + 1; + } + + if (nus.use_enc == false and nus.use_int == false) { + return nas_in; } var octetstring nas_enc := enc_NG_NAS_UL_Message_Type(nas_in) @@ -327,14 +330,15 @@ Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, "Not supported"); } + seq_nr := int2oct(nus.tx_count mod 256, 1); sec_hdr_t := f_NG_NAS_determine_sec_hdr_t(nus.use_enc, nus.use_int, nus.new_ctx); mac := f_NG_NAS_mac_calc(nus.alg_int, nus.k_nas_int, nus.tx_count, bit2int(tsc_NG_RegResult_3GPP), - f_tx_is_downlink(nus), '00'O & nas_enc); + f_tx_is_downlink(nus), seq_nr & nas_enc); nas_out := valueof(cs_NG_SECURITY_PROTECTED_NAS_MESSAGE(tsc_EPD_GMM, sec_hdr_t, mac, - int2oct(nus.tx_count, 1), + seq_nr, nas_enc)); return nas_out; -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I7ea4460c902a5f612243e155a484acc89acd447f Gerrit-Change-Number: 43212 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-ttcn3-hacks[master]: mme: Fix NG NAS ul_count not incremented
by pespin 13 Aug '26

13 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email ) Change subject: mme: Fix NG NAS ul_count not incremented ...................................................................... mme: Fix NG NAS ul_count not incremented Since open5gs.git b9823196b5de3394b7a144569f186d7d62fad6f9, open5gs properly validates received seq_nr (ul_count) of integrity protected 4G NAS message to make sure it increases with each new UL message, in order to protect against accepting replayed messages. This made the mme testsuite fail since our S1AP/4G-NAS emulation was not properly increasing ul_count when sending new messages, but always using ul_count=0. Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980 --- M library/LTE_CryptoFunctions.ttcn 1 file changed, 9 insertions(+), 5 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, approved laforge: Looks good to me, but someone else must approve diff --git a/library/LTE_CryptoFunctions.ttcn b/library/LTE_CryptoFunctions.ttcn index 882861b..954e085 100644 --- a/library/LTE_CryptoFunctions.ttcn +++ b/library/LTE_CryptoFunctions.ttcn @@ -247,13 +247,16 @@ { var BIT4 sec_hdr_t; var PDU_NAS_EPS nas_out; - - if (nus.use_enc == false and nus.use_int == false) { - return nas_in; - } + var OCT1 seq_nr; if (nus.new_ctx) { nus.tx_count := 0; + } else { + nus.tx_count := nus.tx_count + 1; + } + + if (nus.use_enc == false and nus.use_int == false) { + return nas_in; } var octetstring nas_enc := enc_PDU_NAS_EPS(nas_in); @@ -262,11 +265,12 @@ f_tx_is_downlink(nus), nas_enc); } + seq_nr := int2oct(nus.tx_count mod 256, 1); sec_hdr_t := f_nas_determine_sec_hdr_t(nus.use_enc, nus.use_int, nus.new_ctx); nas_out := valueof(ts_NAS_EMM_SecurityProtected(sec_hdr_t, nus.tx_count, nas_enc)); if (nus.use_int) { var OCT4 mac := f_nas_mac_calc(nus.alg_int, nus.k_nas_int, nus.tx_count, 0, - f_tx_is_downlink(nus), '00'O & nas_enc); + f_tx_is_downlink(nus), seq_nr & nas_enc); nas_out.ePS_messages.ePS_MobilityManagement.pDU_NAS_EPS_SecurityProtectedNASMessage.messageAuthenticationCode := mac; } return nas_out; -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980 Gerrit-Change-Number: 43213 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: 5gc: TC_ng_register_ping46_256: Increase Tguard
by pespin 13 Aug '26

13 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43211?usp=email ) Change subject: 5gc: TC_ng_register_ping46_256: Increase Tguard ...................................................................... 5gc: TC_ng_register_ping46_256: Increase Tguard The 30.0 are sometimes not enough to run the test, specially on resource-constrained systems. Change-Id: I312f132094707a39b2980529cf363af4b172e66a --- M 5gc/C5G_Tests.ttcn 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, approved laforge: Looks good to me, but someone else must approve diff --git a/5gc/C5G_Tests.ttcn b/5gc/C5G_Tests.ttcn index 2649a2f..2be26ff 100644 --- a/5gc/C5G_Tests.ttcn +++ b/5gc/C5G_Tests.ttcn @@ -559,7 +559,7 @@ var ConnHdlr vc_conn[256]; var integer i; - f_init(); + f_init(t_guard := 60.0); f_ngap_setup(0); for (i := 0; i < sizeof(vc_conn); i := i + 1) { -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43211?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I312f132094707a39b2980529cf363af4b172e66a Gerrit-Change-Number: 43211 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmocore[master]: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, laforge. pespin has posted comments on this change by laforge. ( https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email ) Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder ...................................................................... Patch Set 2: Code-Review-1 (1 comment) Patchset: PS2: tp is a pointer, not an array. Either change the tp param or pass a num_elem_array or something. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737 Gerrit-Change-Number: 43215 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 08:01:19 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0