August 2026 - gerrit-log - lists.osmocom.org

[S] Change in libosmocore[master]: gb: fix buffer overflow in bssgp_rx_paging()
by pespin 10 Aug '26

10 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email ) Change subject: gb: fix buffer overflow in bssgp_rx_paging() ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43189?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I4b395558a0df2d6f2e755ef16b25f165c0154344 Gerrit-Change-Number: 43189 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Mon, 10 Aug 2026 08:04:52 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-hlr[master]: mslookup: fix size_t underflow in mDNS decode
by osmith 10 Aug '26

10 Aug '26

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email ) Change subject: mslookup: fix size_t underflow in mDNS decode ...................................................................... mslookup: fix size_t underflow in mDNS decode osmo_mdns_rfc_record_decode() computes the strnlen() scan bound as 'data_len - 10' where data_len is a size_t. osmo_mdns_msg_answer_decode() loops "while (data_len)" with no minimum-length guard, so it can call record_decode() with data_len in 1..9. 'data_len - 10' then underflows to ~SIZE_MAX and strnlen() scans far past the receive buffer until it finds a NUL, and data[name_len] reads further still, before the trailing "name_len + 10 + rdlength > data_len" check ever runs. A record must contain at least one name byte plus the 10 fixed trailing bytes (type, class, ttl, rdlength); reject anything shorter so the subtraction cannot underflow. Additionally, an unterminated name still let the fixed-field loads read one byte past the buffer: strnlen() can return its bound, making name_len equal to data_len - 9, so osmo_load16be(data + name_len + 8) touched data[data_len] before the trailing length check ran. Require room for the name plus the 10 fixed trailing bytes before reading any of them. Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 --- M src/mslookup/mdns_rfc.c 1 file changed, 13 insertions(+), 0 deletions(-) Approvals: pespin: Looks good to me, but someone else must approve osmith: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/mslookup/mdns_rfc.c b/src/mslookup/mdns_rfc.c index 8a8cdec..886b4f6 100644 --- a/src/mslookup/mdns_rfc.c +++ b/src/mslookup/mdns_rfc.c @@ -156,10 +156,23 @@ struct osmo_mdns_rfc_record *ret; size_t name_len; + /* A record needs at least one name byte plus the 10 fixed trailing + * bytes (type, class, ttl, rdlength). Reject anything shorter, so the + * unsigned 'data_len - 10' below cannot underflow to ~SIZE_MAX. */ + if (data_len < 11) + return NULL; + /* name length: represented as a series of labels, and terminated by a * label with zero length (RFC 1035 3.3). A label with zero length is a * NUL byte. */ name_len = strnlen((const char *)data, data_len - 10) + 1; + /* If no label terminator was found within the scanned range, strnlen() + * returns its bound, so name_len can be as large as data_len - 9. The + * fixed-field loads below read up to data[name_len + 9], which would then + * be one byte past the buffer. Require room for the name plus the 10 + * fixed trailing bytes before touching any of them. */ + if (name_len + 10 > data_len) + return NULL; if (data[name_len]) return NULL; -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 Gerrit-Change-Number: 42888 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: laforge <laforge(a)osmocom.org>

1 0

[S] Change in osmo-hlr[master]: mslookup: fix size_t underflow in mDNS decode
by osmith 10 Aug '26

10 Aug '26

Attention is currently required from: fixeria, n0k0, neels. osmith has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email ) Change subject: mslookup: fix size_t underflow in mDNS decode ...................................................................... Patch Set 4: Code-Review+2 (1 comment) Patchset: PS4: Thanks! -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 Gerrit-Change-Number: 42888 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-Attention: neels <nhofmeyr(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Mon, 10 Aug 2026 07:52:07 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in libasn1c[master]: constr_CHOICE: fix always-true bounds check
by n0k0 10 Aug '26

10 Aug '26

Attention is currently required from: laforge. n0k0 has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email ) Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... Patch Set 3: (1 comment) Patchset: PS3: > this must first and foremost be fixed in upstream asn1c, if it hasn't yet, as libasn1c is merely a s […] I'll look into it when I get some time to spare :) -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Mon, 10 Aug 2026 07:18:22 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in libsmpp34[master]: smpp34_unpack: bound C_OCTET scan with strnlen()
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email ) Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libsmpp34 Gerrit-Branch: master Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 Gerrit-Change-Number: 42889 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:25:27 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-iuh[master]: iu_client: reject oversized RANAP NAS-PDU
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email ) Change subject: iu_client: reject oversized RANAP NAS-PDU ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I7dbce926477f9842cd466d46cda836638f04011f Gerrit-Change-Number: 42887 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:24:34 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libasn1c[master]: constr_CHOICE: fix always-true bounds check
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email ) Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... Patch Set 3: Code-Review+1 (1 comment) Patchset: PS3: this must first and foremost be fixed in upstream asn1c, if it hasn't yet, as libasn1c is merely a shared library version of the asn1c runtime. -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:23:02 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by laforge 10 Aug '26

10 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... ipaccess-proxy: reject oversized IPA frame length ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the wire header and passes it straight as the recv() count into a msgb that was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever checking it against the buffer tailroom. A peer that advertises a body length larger than the remaining buffer space makes recv() write past the end of the heap allocation (heap buffer overflow). Reject frames whose advertised length exceeds the msgb tailroom, the same way the other IPA read paths bound the read to msgb_tailroom(). This issue has been assigned the CVE candidate identifier CAN-2026-2051036. Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 6 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved fixeria: Looks good to me, but someone else must approve diff --git a/src/ipaccess/ipaccess-proxy.c b/src/ipaccess/ipaccess-proxy.c index 61c2fc2..71190f6 100644 --- a/src/ipaccess/ipaccess-proxy.c +++ b/src/ipaccess/ipaccess-proxy.c @@ -583,6 +583,12 @@ /* then read the length as specified in header */ msg->l2h = msg->data + sizeof(*hh); len = ntohs(hh->len); + if (len > msgb_tailroom(msg)) { + LOGP(DLINP, LOGL_ERROR, "Oversized IPA frame: len %d > tailroom %d\n", len, msgb_tailroom(msg)); + msgb_free(msg); + *error = -EIO; + return NULL; + } ret = recv(bfd->fd, msg->l2h, len, 0); if (ret < len) { LOGP(DLINP, LOGL_ERROR, "short read!\n"); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 5 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject short IPA header
by laforge 10 Aug '26

10 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header ...................................................................... ipaccess-proxy: reject short IPA header recv() of the 3-byte IPA header can return fewer than 3 bytes on a stream socket. ipaccess_proxy_read_msg() only handles ret < 0 and ret == 0, so a short read falls through: msgb_put() advances msg->tail by 'ret' while msg->l2h is set to msg->data + sizeof(*hh). The frame length is then validated against msgb_tailroom() (measured from msg->tail), so the subsequent body recv() into msg->l2h can write up to sizeof(*hh) - ret bytes past the msgb. Reject a short header, the same way handle_udp_read() already does. Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 10 insertions(+), 0 deletions(-) Approvals: fixeria: Looks good to me, but someone else must approve Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/src/ipaccess/ipaccess-proxy.c b/src/ipaccess/ipaccess-proxy.c index 71190f6..b1c500c 100644 --- a/src/ipaccess/ipaccess-proxy.c +++ b/src/ipaccess/ipaccess-proxy.c @@ -576,6 +576,16 @@ msgb_free(msg); *error = ret; return NULL; + } else if (ret < sizeof(*hh)) { + /* A short (split) IPA header would leave msg->l2h (msg->data + + * sizeof(*hh)) ahead of msg->tail, while the frame length below is + * validated against msgb_tailroom() measured from msg->tail; the + * body recv() could then write up to sizeof(*hh) - ret bytes past + * the buffer. Reject it, like the other IPA read paths do. */ + LOGP(DLINP, LOGL_ERROR, "short read of IPA header (%d)\n", ret); + msgb_free(msg); + *error = -EIO; + return NULL; } msgb_put(msg, ret); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 2 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject short IPA header
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 2 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:22:01 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0