August 2026 - gerrit-log - lists.osmocom.org

[S] Change in osmo-ggsn[master]: gtp: clamp GSN-Address copy to sockaddr_in size
by pespin 07 Aug '26

07 Aug '26

Attention is currently required from: n0k0. pespin has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email ) Change subject: gtp: clamp GSN-Address copy to sockaddr_in size ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 Gerrit-Change-Number: 43187 Gerrit-PatchSet: 1 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 20:53:32 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-hlr[master]: mslookup: fix size_t underflow in mDNS decode
by pespin 07 Aug '26

07 Aug '26

Attention is currently required from: fixeria, n0k0. pespin has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email ) Change subject: mslookup: fix size_t underflow in mDNS decode ...................................................................... Patch Set 4: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 Gerrit-Change-Number: 42888 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 20:51:46 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by pespin 07 Aug '26

07 Aug '26

Attention is currently required from: fixeria, n0k0. pespin has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... Patch Set 4: (1 comment) Patchset: PS4: Please actually break this into 2 patches, you added an unrelated problem/change in the new version. -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 20:49:31 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[S] Change in osmo-ggsn[master]: gtp: clamp GSN-Address copy to sockaddr_in size
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email ) Change subject: gtp: clamp GSN-Address copy to sockaddr_in size ...................................................................... gtp: clamp GSN-Address copy to sockaddr_in size gtp_data_req() builds an IPv4 destination sockaddr_in and does memcpy(&addr.sin_addr, pdp->gsnru.v, pdp->gsnru.l); gtp_gpdu_ind() checks the GPDU source with memcmp(&peer->sin_addr, pdp->gsnru.v, pdp->gsnru.l). Both use the wire GSN-Address length as the count into the 4-byte sin_addr, so a GSN-Address longer than 4 bytes (e.g. a 16-byte IPv6 address) writes up to 4 bytes past the sockaddr_in on the stack, or reads up to 12 bytes past sin_addr. Both sites already carried a 'TODO range check' comment. This is the AF_INET user-plane path, where the GSN address is a 4-byte IPv4 address, so copy and compare exactly sizeof(sin_addr) bytes. Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 --- M gtp/gtp.c 1 file changed, 8 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ggsn refs/changes/87/43187/1 diff --git a/gtp/gtp.c b/gtp/gtp.c index fa65575..7a439d9 100644 --- a/gtp/gtp.c +++ b/gtp/gtp.c @@ -3280,7 +3280,10 @@ } /* If the GPDU was not from the peer GSN tell him to delete context */ - if (memcmp(&peer->sin_addr, pdp->gsnru.v, pdp->gsnru.l)) { /* TODO Range? */ + /* Compare only the IPv4 address bytes; peer->sin_addr is 4 bytes, so + * bound the compare to sizeof(sin_addr) rather than the (attacker-influenced) + * gsnru length to avoid reading past sin_addr. */ + if (memcmp(&peer->sin_addr, pdp->gsnru.v, sizeof(peer->sin_addr))) { rate_ctr_inc2(gsn->ctrg, GSN_CTR_ERR_UNKNOWN_PDP); GTP_LOGPKG(LOGL_ERROR, peer, pack, len, "Unknown GSN peer %s\n", inet_ntoa(peer->sin_addr)); return gtp_error_ind_resp(gsn, version, peer, fd, pack, len); @@ -3778,7 +3781,10 @@ #if defined(__FreeBSD__) || defined(__APPLE__) addr.sin_len = sizeof(addr); #endif - memcpy(&addr.sin_addr, pdp->gsnru.v, pdp->gsnru.l); /* TODO range check */ + /* gsnru is the IPv4 GSN user-plane address for this AF_INET path; copy + * exactly sizeof(sin_addr) bytes so an over-long (e.g. 16-byte IPv6) + * address cannot write past addr on the stack. */ + memcpy(&addr.sin_addr, pdp->gsnru.v, sizeof(addr.sin_addr)); /* prepare msghdr */ memset(&msgh, 0, sizeof(msgh)); -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 Gerrit-Change-Number: 43187 Gerrit-PatchSet: 1 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[S] Change in osmo-hlr[master]: mslookup: fix size_t underflow in mDNS decode
by n0k0 07 Aug '26

07 Aug '26

Attention is currently required from: fixeria, n0k0. Hello Jenkins Builder, fixeria, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email to look at the new patch set (#4). The following approvals got outdated and were removed: Code-Review+1 by fixeria, Verified+1 by Jenkins Builder Change subject: mslookup: fix size_t underflow in mDNS decode ...................................................................... mslookup: fix size_t underflow in mDNS decode osmo_mdns_rfc_record_decode() computes the strnlen() scan bound as 'data_len - 10' where data_len is a size_t. osmo_mdns_msg_answer_decode() loops "while (data_len)" with no minimum-length guard, so it can call record_decode() with data_len in 1..9. 'data_len - 10' then underflows to ~SIZE_MAX and strnlen() scans far past the receive buffer until it finds a NUL, and data[name_len] reads further still, before the trailing "name_len + 10 + rdlength > data_len" check ever runs. A record must contain at least one name byte plus the 10 fixed trailing bytes (type, class, ttl, rdlength); reject anything shorter so the subtraction cannot underflow. Additionally, an unterminated name still let the fixed-field loads read one byte past the buffer: strnlen() can return its bound, making name_len equal to data_len - 9, so osmo_load16be(data + name_len + 8) touched data[data_len] before the trailing length check ran. Require room for the name plus the 10 fixed trailing bytes before reading any of them. Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 --- M src/mslookup/mdns_rfc.c 1 file changed, 13 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-hlr refs/changes/88/42888/4 -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 Gerrit-Change-Number: 42888 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by n0k0 07 Aug '26

07 Aug '26

Attention is currently required from: fixeria, n0k0, pespin. Hello fixeria, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email to look at the new patch set (#4). The following approvals got outdated and were removed: Code-Review+1 by pespin, Code-Review+2 by fixeria Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... ipaccess-proxy: reject oversized IPA frame length ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the wire header and passes it straight as the recv() count into a msgb that was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever checking it against the buffer tailroom. A peer that advertises a body length larger than the remaining buffer space makes recv() write past the end of the heap allocation (heap buffer overflow). Reject frames whose advertised length exceeds the msgb tailroom, the same way the other IPA read paths bound the read to msgb_tailroom(). Also reject a short (split) IPA header: recv() of the 3-byte header can return fewer than 3 bytes on a stream socket, which left msg->l2h ahead of msg->tail while the length was validated against msgb_tailroom() (measured from msg->tail), so a 1-2 byte body overflow was still possible. Bail out on a short header, as the other IPA read paths do. This issue has been assigned the CVE candidate identifier CAN-2026-2051036. Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 16 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/86/42886/4 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in onomondo-eim[master]: esipa_rest_utils: add support for PSMOs added in SGP.32 V.1.2
by fixeria 07 Aug '26

07 Aug '26

Attention is currently required from: dexter, jolly. fixeria has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/42881?usp=email ) Change subject: esipa_rest_utils: add support for PSMOs added in SGP.32 V.1.2 ...................................................................... Patch Set 9: (1 comment) File contrib/rest_api_resource_schema.json: https://gerrit.osmocom.org/c/onomondo-eim/+/42881/comment/b8ef3d08_1f192b9a… : PS9, Line 169: , > Are you sure? I always thought the ',' is a delimiter. I used SGP.32, section 6.4.1. as an example. […] @andreas@eversberg.eu is right here. `[0-9,A-F]` literally matches digits, uppercase letters, and the coma character. You can check/debug regular expressions here: https://regex101.com/. -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/42881?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I03cdd70065a83dfc611d614cf32d817c13fad347 Gerrit-Change-Number: 42881 Gerrit-PatchSet: 9 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: jolly <andreas(a)eversberg.eu> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 16:15:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: jolly <andreas(a)eversberg.eu> Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in osmo-hlr[master]: mslookup: fix size_t underflow in mDNS decode
by fixeria 07 Aug '26

07 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email ) Change subject: mslookup: fix size_t underflow in mDNS decode ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 Gerrit-Change-Number: 42888 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 16:03:30 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libasn1c[master]: constr_CHOICE: fix always-true bounds check
by fixeria 07 Aug '26

07 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email ) Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 16:02:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in onomondo-ipa[master]: V1.2: Add function ES10b.DisableEmergencyProfile
by dexter 07 Aug '26

07 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/onomondo-ipa/+/43044?usp=email ) Change subject: V1.2: Add function ES10b.DisableEmergencyProfile ...................................................................... Patch Set 3: Code-Review+1 (3 comments) File include/onomondo/ipa/ipad.h: https://gerrit.osmocom.org/c/onomondo-ipa/+/43044/comment/152d9447_f5c1ce33… : PS3, Line 100: int ipa_disable_emergency_profile(struct ipa_context *ctx); maybe shorten "profile" to "prfle" and "emergency" to "emerg"? File src/ipa/libipa/es10b_dis_emerg_prfle.h: https://gerrit.osmocom.org/c/onomondo-ipa/+/43044/comment/ee9fba39_2eeedfbf… : PS3, Line 14: struct DisableEmergencyProfileResponse *res; Also here, maybe just return the integer result? File src/ipa/main.c: https://gerrit.osmocom.org/c/onomondo-ipa/+/43044/comment/3c407d0d_264c228f… : PS3, Line 56: printf(" --disable-emergency-profile. Trigger return from emergency profile to previous profile\n"); > see my comment on an earlier patch of this series about options that are […] Acknowledged -- To view, visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43044?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-ipa Gerrit-Branch: master Gerrit-Change-Id: I2af2077228fb8c5fa3f254acc15bd0afaa33fe43 Gerrit-Change-Number: 43044 Gerrit-PatchSet: 3 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Fri, 07 Aug 2026 15:58:42 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0