August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in onomondo-eim[master]: SGP32Definitions: remove wrong comment about workaround
by dexter 12 Aug '26

12 Aug '26

dexter has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43174?usp=email ) ( 1 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: SGP32Definitions: remove wrong comment about workaround ...................................................................... SGP32Definitions: remove wrong comment about workaround This patch removes a misplaced workaround comment. The ASN.1 structures in questions are equal to the original spec and were not modified. Related: SYS#8100 Change-Id: Ibba9f380f32ddb947210cedf028460deb22e22ea --- M asn1/SGP32Definitions.asn1 1 file changed, 0 insertions(+), 2 deletions(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/asn1/SGP32Definitions.asn1 b/asn1/SGP32Definitions.asn1 index dffa6c8..cc052b4 100644 --- a/asn1/SGP32Definitions.asn1 +++ b/asn1/SGP32Definitions.asn1 @@ -607,11 +607,9 @@ parametersNotAvailable(1), undefinedError(127) } --- workaround for erlang asn1ct: remove already specified context-specific tag SGP32-SetDefaultDpAddressRequest ::= [101] SEQUENCE { -- Tag 'BF65' defaultDpAddress UTF8String -- Default SM-DP+ address as an FQDN } --- workaround for erlang asn1ct: remove already specified context-specific tag SGP32-SetDefaultDpAddressResponse ::= [101] SEQUENCE { -- Tag 'BF65' setDefaultDpAddressResult INTEGER { ok (0), undefinedError (127)} } -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43174?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ibba9f380f32ddb947210cedf028460deb22e22ea Gerrit-Change-Number: 43174 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in onomondo-eim[master]: SGP32Definitions: remove wrong comment about workaround
by dexter 12 Aug '26

12 Aug '26

Attention is currently required from: dexter. Hello Jenkins Builder, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/onomondo-eim/+/43174?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: SGP32Definitions: remove wrong comment about workaround ...................................................................... SGP32Definitions: remove wrong comment about workaround This patch removes a misplaced workaround comment. The ASN.1 structures in questions are equal to the original spec and were not modified. Related: SYS#8100 Change-Id: Ibba9f380f32ddb947210cedf028460deb22e22ea --- M asn1/SGP32Definitions.asn1 1 file changed, 0 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/74/43174/2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43174?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ibba9f380f32ddb947210cedf028460deb22e22ea Gerrit-Change-Number: 43174 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in onomondo-eim[master]: onomondo_eim_app: unify HTTP/HTTPs server startup
by dexter 12 Aug '26

12 Aug '26

dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43087?usp=email ) Change subject: onomondo_eim_app: unify HTTP/HTTPs server startup ...................................................................... Patch Set 4: Code-Review+1 (1 comment) Patchset: PS4: (restoring original vote state) -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43087?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ie63a97b7ca6873d02866a11226733b37017504cd Gerrit-Change-Number: 43087 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Wed, 12 Aug 2026 12:54:42 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[S] Change in onomondo-eim[master]: onomondo_eim_app: unify HTTP/HTTPs server startup
by dexter 12 Aug '26

12 Aug '26

dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43087?usp=email ) The change is no longer submittable: Code-Review is unsatisfied now. Change subject: onomondo_eim_app: unify HTTP/HTTPs server startup ...................................................................... Patch Set 4: -Code-Review -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43087?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ie63a97b7ca6873d02866a11226733b37017504cd Gerrit-Change-Number: 43087 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Wed, 12 Aug 2026 12:49:21 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in onomondo-eim[master]: onomondo_eim_app: unify HTTP/HTTPs server startup
by dexter 12 Aug '26

12 Aug '26

dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43087?usp=email ) Change subject: onomondo_eim_app: unify HTTP/HTTPs server startup ...................................................................... Patch Set 4: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43087?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ie63a97b7ca6873d02866a11226733b37017504cd Gerrit-Change-Number: 43087 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Wed, 12 Aug 2026 12:49:05 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in simtrace2[master]: Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA
by lynxis lazus 12 Aug '26

12 Aug '26

Attention is currently required from: dexter, laforge, lynxis lazus. Hello Jenkins Builder, dexter, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/simtrace2/+/43185?usp=email to look at the new patch set (#5). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA ...................................................................... Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA osmo_apdu_segment_in() doesn't have the context of the previous APDU, for nearly all calls this is fine, except for GP GET DATA, which can be a case 2 or case 4 APDU. GP GET DATA defines the Le field as 0x00 which is used by osmo_apdu_segment_in to detect if it is a case 2 or case 4. But if the card responded to a case 2 GP GET DATA with Le = 0 with a SW 6cXX, the previous GP GET DATA case 2 must resent with a Le field to XX, which got misinterpreted by the osmo_apdu_segment_in() as a case 4 instead of a case 2 with Le != 0. Introduce osmo_apdu_segment_in2() containing the previous APDU as context. Modem <-> Card 81cadf2000 -> <- 6c0b 81cadf200b -> -- waits for more data, because it decodes the last TPDU as a case 4 instead of a case 2. Related: SYS#8147 Change-Id: Ie238662e7e6a10dd4283ede0c8d8d73bc375c247 --- M TODO-RELEASE M host/Makefile.am M host/configure.ac M host/include/osmocom/simtrace2/apdu_dispatch.h M host/lib/apdu_dispatch.c A host/tests/Makefile.am A host/tests/apdu_dispatch/Makefile.am A host/tests/apdu_dispatch/apdu_dispatch_test.c A host/tests/apdu_dispatch/apdu_dispatch_test.ok A host/tests/testsuite.at 10 files changed, 196 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/simtrace2 refs/changes/85/43185/5 -- To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43185?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: simtrace2 Gerrit-Branch: master Gerrit-Change-Id: Ie238662e7e6a10dd4283ede0c8d8d73bc375c247 Gerrit-Change-Number: 43185 Gerrit-PatchSet: 5 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in libasn1c[master]: constr_CHOICE: fix always-true bounds check
by laforge 12 Aug '26

12 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email ) Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... constr_CHOICE: fix always-true bounds check The guard around the td->elements[present - 1] access uses "present > 0 || present <= td->elements_count". Because every int satisfies at least one of the two clauses, the condition is always true, so a present index of 0 or one greater than elements_count indexes the elements array out of bounds (out of bounds read). Use "&&" so the access is taken only when present is within [1, elements_count], matching the equivalent checks already used in CHOICE_constraint() and the print/compare helpers in this file. Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf --- M src/constr_CHOICE.c 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/constr_CHOICE.c b/src/constr_CHOICE.c index df68feb..4397ad1 100644 --- a/src/constr_CHOICE.c +++ b/src/constr_CHOICE.c @@ -457,7 +457,7 @@ */ present = _fetch_present_idx(ptr, specs->pres_offset, specs->pres_size); - if(present > 0 || present <= td->elements_count) { + if (present > 0 && present <= td->elements_count) { const asn_TYPE_member_t *elm = &td->elements[present-1]; const void *memb_ptr; -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in libasn1c[master]: constr_CHOICE: fix always-true bounds check
by laforge 12 Aug '26

12 Aug '26

Attention is currently required from: fixeria, n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email ) Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... Patch Set 4: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Wed, 12 Aug 2026 12:20:05 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libsmpp34[master]: smpp34_unpack: bound C_OCTET scan with strnlen()
by laforge 12 Aug '26

12 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email ) Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ...................................................................... smpp34_unpack: bound C_OCTET scan with strnlen() The C_OCTET macro runs strlen() on the attacker-controlled wire buffer before any bounds check. SMPP PDUs are decoded straight out of a buffer sized exactly to the wire command_length with no trailing NUL, so a C-Octet-String field that runs to the end of the buffer without a terminator makes strlen() read past the end of the allocation (out of bounds heap read), and the post-hoc "lenval > left" check runs only after the over-read has already happened. Scan with strnlen(aux, left) so the read can never go past the remaining buffer; if no terminator is found within 'left' bytes, lenval becomes left + 1 and the existing length check rejects the PDU. This issue has been assigned the CVE candidate identifier CAN-2026-2051038. Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 --- M src/smpp34_unpack.c 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved diff --git a/src/smpp34_unpack.c b/src/smpp34_unpack.c index ec73d35..47d34ba 100644 --- a/src/smpp34_unpack.c +++ b/src/smpp34_unpack.c @@ -127,7 +127,7 @@ #define C_OCTET( inst, par, size ){\ - lenval = strlen( (char*) aux ) + 1;\ + lenval = strnlen((char *)aux, left) + 1;\ if( lenval > left ){\ PUTLOG("[len(%s):%d(%s)]", par, lenval, \ "Value length exceed buffer length");\ -- To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libsmpp34 Gerrit-Branch: master Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 Gerrit-Change-Number: 42889 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libsmpp34[master]: smpp34_unpack: bound C_OCTET scan with strnlen()
by laforge 12 Aug '26

12 Aug '26

Attention is currently required from: fixeria, n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email ) Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ...................................................................... Patch Set 4: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libsmpp34 Gerrit-Branch: master Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 Gerrit-Change-Number: 42889 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Wed, 12 Aug 2026 12:19:50 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0