August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-ttcn3-hacks[master]: stp: TCAP: re-work tests as the TCAP routing changed
by laforge 10 Aug '26

10 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43192?usp=email ) Change subject: stp: TCAP: re-work tests as the TCAP routing changed ...................................................................... stp: TCAP: re-work tests as the TCAP routing changed Original the TCAP routing was designed in a different way. The original concept was to load-balance the TCAP sessions when they originate from M3UA -> IPA by the oTID. This changed into load-balancing TCAP sessions from M3UA -> IPA and track the session with the IPA/TCAP ids. Change-Id: Ib97a158fe544a72231aa31a7ec226736eeb32fcb --- M stp/STP_Tests_TCAP.ttcn 1 file changed, 4 insertions(+), 3 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved diff --git a/stp/STP_Tests_TCAP.ttcn b/stp/STP_Tests_TCAP.ttcn index bc16337..16874b2 100644 --- a/stp/STP_Tests_TCAP.ttcn +++ b/stp/STP_Tests_TCAP.ttcn @@ -608,7 +608,7 @@ tcap_rt_msg.u.add_range.tid_end := 199; f_asp_tx_ipa_ext_tcap_routing(tcap_rt_msg, 3); - f_asp_tx_tcap_m3ua_ipa_transaction(0, 2, int2oct(2345, 4), int2oct(42, 4)); + f_asp_tx_tcap_m3ua_ipa_continue(0, 2, int2oct(2345, 4), int2oct(42, 4)); setverdict(pass); } @@ -760,7 +760,7 @@ pc := tcap_configs[2].cfg.own_pc, ssn := tcap_configs[2].cfg.own_ssn); f_asp_tx_ipa_ext_tcap_routing(tcap_rt_msg, 3); - f_asp_tx_tcap_m3ua_ipa_transaction(0, 3, int2oct(60, 4), int2oct(70, 4)); + f_asp_tx_tcap_m3ua_ipa_continue(0, 3, int2oct(60, 4), int2oct(70, 4)); setverdict(pass); } @@ -787,7 +787,8 @@ pc := IPA_EXT_TCAP_ROUTING_PC_WILDCARD, ssn := tcap_configs[2].cfg.own_ssn); f_asp_tx_ipa_ext_tcap_routing(tcap_rt_msg, 3); - f_asp_tx_tcap_m3ua_ipa_transaction(0, 3, int2oct(60, 4), int2oct(99, 4)); + f_asp_tx_tcap_m3ua_ipa_continue(0, 3, int2oct(79, 4), int2oct(60, 4)); + f_asp_tx_tcap_m3ua_ipa_continue(0, 2, int2oct(79, 4), int2oct(81, 4)); setverdict(pass); } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43192?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ib97a158fe544a72231aa31a7ec226736eeb32fcb Gerrit-Change-Number: 43192 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: stp: TCAP: re-work tests as the TCAP routing changed
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: daniel, lynxis lazus. laforge has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43192?usp=email ) Change subject: stp: TCAP: re-work tests as the TCAP routing changed ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43192?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ib97a158fe544a72231aa31a7ec226736eeb32fcb Gerrit-Change-Number: 43192 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Mon, 10 Aug 2026 09:37:31 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by dexter 10 Aug '26

10 Aug '26

Attention is currently required from: Hoernchen, laforge. dexter has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43172?usp=email ) Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 2 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Mon, 10 Aug 2026 09:37:11 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmocore[master]: gb: fix buffer overflow in bssgp_rx_paging()
by laforge 10 Aug '26

10 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email ) Change subject: gb: fix buffer overflow in bssgp_rx_paging() ...................................................................... gb: fix buffer overflow in bssgp_rx_paging() gsm48_parse_ra() was called against a local 6-byte buffer that was first memcpy()'d from TLVP_VAL() using the IE's own TLVP_LEN(), which can exceed 6 bytes for BSSGP_IE_LOCATION_AREA (5 bytes expected) and BSSGP_IE_ROUTEING_AREA (6 bytes expected) when a peer sends a larger IE, overflowing ra[]. Drop the intermediate copy and pass the TLV pointer directly to gsm48_parse_ra(), which only reads the bytes it needs. Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Fixes: OS#7043 --- M src/gb/gprs_bssgp_bss.c 1 file changed, 2 insertions(+), 9 deletions(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve diff --git a/src/gb/gprs_bssgp_bss.c b/src/gb/gprs_bssgp_bss.c index 8230d87..dbb1e4b 100644 --- a/src/gb/gprs_bssgp_bss.c +++ b/src/gb/gprs_bssgp_bss.c @@ -479,11 +479,8 @@ struct bssgp_normal_hdr *bgph = (struct bssgp_normal_hdr *) msgb_bssgph(msg); struct tlv_parsed tp; - uint8_t ra[6]; int rc, data_len; - memset(ra, 0, sizeof(ra)); - data_len = msgb_bssgp_len(msg) - sizeof(*bgph); rc = bssgp_tlv_parse(&tp, bgph->data, data_len); if (rc < 0) @@ -519,14 +516,10 @@ pinfo->scope = BSSGP_PAGING_BSS_AREA; } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_LOCATION_AREA, 5)) { pinfo->scope = BSSGP_PAGING_LOCATION_AREA; - memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA), - TLVP_LEN(&tp, BSSGP_IE_LOCATION_AREA)); - gsm48_parse_ra(&pinfo->raid, ra); + gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA)); } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_ROUTEING_AREA, 6)) { pinfo->scope = BSSGP_PAGING_ROUTEING_AREA; - memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA), - TLVP_LEN(&tp, BSSGP_IE_ROUTEING_AREA)); - gsm48_parse_ra(&pinfo->raid, ra); + gsm48_parse_ra(&pinfo->raid, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA)); } else if (TLVP_PRES_LEN(&tp, BSSGP_IE_BVCI, 2)) { pinfo->scope = BSSGP_PAGING_BVCI; pinfo->bvci = tlvp_val16be(&tp, BSSGP_IE_BVCI); -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Gerrit-Change-Number: 43189 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm0480: fix out-of-bounds read in parse_process_uss_req()
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: fixeria. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43191?usp=email ) Change subject: gsm0480: fix out-of-bounds read in parse_process_uss_req() ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43191?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I62a2ea539238d8c2dbab897ce2f80b9ab905a108 Gerrit-Change-Number: 43191 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Mon, 10 Aug 2026 09:36:43 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmocore[master]: gsm29205: fix out-of-bounds read in osmo_dec_gcr()
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: fixeria. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email ) Change subject: gsm29205: fix out-of-bounds read in osmo_dec_gcr() ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I6855d6c810c2b4274ccfd7bc861405f9b4e09343 Gerrit-Change-Number: 43190 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Mon, 10 Aug 2026 09:36:29 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmocore[master]: gb: fix buffer overflow in bssgp_rx_paging()
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: fixeria. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email ) Change subject: gb: fix buffer overflow in bssgp_rx_paging() ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Gerrit-Change-Number: 43189 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Mon, 10 Aug 2026 09:35:52 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in pysim[master]: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files
by laforge 10 Aug '26

10 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/41581?usp=email ) Change subject: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files ...................................................................... ts_31_102: EF SUCI_Calc_Info: fix decoding empty files When trying to use `edit_binary_decoded` with an empty file, pysim runs into a len(None) exception, because hpkl.to_dict()['hnet_pubkey_list'] returns None. Can reproduced with a CCC Camp 2023 usim and editing the file. a000ff..ff (len = 200) Co-authored-by: Harald Welte <laforge(a)osmocom.org> Change-Id: Ib8e322e65dd768bfd49e7a5620a2163f12a74ec7 --- M pySim/ts_31_102.py 1 file changed, 9 insertions(+), 1 deletion(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/pySim/ts_31_102.py b/pySim/ts_31_102.py index 2f7b945..b354b32 100644 --- a/pySim/ts_31_102.py +++ b/pySim/ts_31_102.py @@ -285,6 +285,14 @@ {"hnet_pubkey_identifier": 11, "hnet_pubkey": h2b("d1bc365f4997d17ce4374e72181431cbfeba9e1b98d7618f79d48561b144672a")}]} ), ] + _test_decode = [ + ( 'A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF', + {"prot_scheme_id_list": [], + "hnet_pubkey_list": []} ), + ( 'A000A100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF', + {"prot_scheme_id_list": [], + "hnet_pubkey_list": []} ), + ] # 3GPP TS 31.102 Section 4.4.11.8 class ProtSchemeIdList(BER_TLV_IE, tag=0xa0): # FIXME: 3GPP TS 24.501 Protection Scheme Identifier @@ -389,7 +397,7 @@ # remaining data holds Home Network Public Key Data Object hpkl = EF_SUCI_Calc_Info.HnetPubkeyList() hpkl.from_tlv(in_bytes[pos:]) - hnet_pubkey_list = self._compact_pubkey_list(hpkl.to_dict()['hnet_pubkey_list']) + hnet_pubkey_list = self._compact_pubkey_list(hpkl.to_dict()['hnet_pubkey_list'] or []) return { 'prot_scheme_id_list': prot_scheme_id_list, -- To view, visit https://gerrit.osmocom.org/c/pysim/+/41581?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ib8e322e65dd768bfd49e7a5620a2163f12a74ec7 Gerrit-Change-Number: 41581 Gerrit-PatchSet: 3 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[S] Change in pysim[master]: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: lynxis lazus. laforge has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/pysim/+/41581?usp=email ) Change subject: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/41581?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ib8e322e65dd768bfd49e7a5620a2163f12a74ec7 Gerrit-Change-Number: 41581 Gerrit-PatchSet: 3 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Mon, 10 Aug 2026 09:35:14 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: TCAP: LOG: fix missing newlines in log messages
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: daniel, lynxis lazus. laforge has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43194?usp=email ) Change subject: TCAP: LOG: fix missing newlines in log messages ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43194?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Id57d8afeb01412ed7448bb27148be87980f4f906 Gerrit-Change-Number: 43194 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Mon, 10 Aug 2026 09:34:25 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0