Attention is currently required from: laforge.
pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email )
Change subject: 5gc: keep NUS after UeContextRelease
......................................................................
Patch Set 2:
(1 comment)
Patchset:
PS2:
> Isn't there some more automatic way how we can unburden the test cases from manually managing the nu […]
TBH the more I work with the NGAP/S1AP Emulation the more I see stuffing the NAS enc/dec in there was a bad idea, as it comes with all sorts of limitations and problems.
In the end the NAS send/recv from NGAP/S1AP_Emulation is only used with UplinkTransport and DownlinkTransport, and can't be used to eg. send NAS on other types of messages like the one in this test. It also creates problems in DL messages containing multiple NAS messages (eg. creating multiple bearers).
The more I look into it, the more I think the NAS state should be kept in the ConnHdlr of the test and operate on it directly.
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3
Gerrit-Change-Number: 43214
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: laforge <laforge(a)osmocom.org>
Gerrit-CC: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Comment-Date: Thu, 13 Aug 2026 07:59:07 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: laforge <laforge(a)osmocom.org>
Attention is currently required from: pespin.
osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email )
Change subject: mme: Fix NG NAS ul_count not incremented
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980
Gerrit-Change-Number: 43213
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Thu, 13 Aug 2026 06:50:03 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Attention is currently required from: pespin.
osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email )
Change subject: 5gc: Fix NG NAS ul_count not incremented
......................................................................
Patch Set 2: Code-Review+2
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I7ea4460c902a5f612243e155a484acc89acd447f
Gerrit-Change-Number: 43212
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Thu, 13 Aug 2026 06:48:57 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
laforge has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email )
Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
......................................................................
gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
cbsp_dec_write_repl() then takes the 8-bit page count straight off the
wire and uses it as the bound over an array of 16 entries, overflowing
the array on the heap.
Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Closes: OS#7053
---
M src/gsm/cbsp.c
1 file changed, 3 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/15/43215/2
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Gerrit-Change-Number: 43215
Gerrit-PatchSet: 2
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Gerrit-CC: Jenkins Builder
laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email )
Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
......................................................................
gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
cbsp_dec_write_repl() then takes the 8-bit page count straight off the
wire and uses it as the bound over an array of 16 entries, overflowing
the array on the heap.
Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
---
M src/gsm/cbsp.c
1 file changed, 3 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/15/43215/1
diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c
index a5e58f4..7532ca9 100644
--- a/src/gsm/cbsp.c
+++ b/src/gsm/cbsp.c
@@ -684,8 +684,10 @@
out->u.cbs.num_bcast_req = tlvp_val16be(tp, CBSP_IEI_NUM_BCAST_REQ);
out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS);
num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES);
- if (num_of_pages < 1)
+ if (num_of_pages < 1 || num_of_pages > ARRAY_SIZE(tp)) {
+ osmo_cbsp_errstr = "invalid number of pages";
return -EINVAL;
+ }
/* parse pages */
for (i = 0; i < num_of_pages; i++) {
const uint8_t *ie = TLVP_VAL(&tp[i], CBSP_IEI_MSG_CONTENT);
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Gerrit-Change-Number: 43215
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Attention is currently required from: pespin.
laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email )
Change subject: mme: Fix NG NAS ul_count not incremented
......................................................................
Patch Set 1: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980
Gerrit-Change-Number: 43213
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Wed, 12 Aug 2026 19:15:19 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Attention is currently required from: pespin.
laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email )
Change subject: 5gc: Fix NG NAS ul_count not incremented
......................................................................
Patch Set 2: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I7ea4460c902a5f612243e155a484acc89acd447f
Gerrit-Change-Number: 43212
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Wed, 12 Aug 2026 19:15:08 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes