August 2026 - gerrit-log - lists.osmocom.org

[S] Change in libosmo-sigtran[master]: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
by fixeria 04 Aug '26

04 Aug '26

Attention is currently required from: pespin. fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email ) Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse() ...................................................................... Patch Set 2: (1 comment) File src/sccp2sua.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163/comment/0982b8f9_420cc… : PS1, Line 74: if (in_num_bytes * 2 >= out_digits_size) > Note that the check is using `>=`, i.e. […] Ah, I guess I know what you mean. The output buffer is `digits[32]`, so we can accept up to 31 BCD-digits + `'\0'`. If the input is `in_num_bytes=32` and `odd=true` (i.e. the input contains 31 BCD-digits), we'll reject it for no good reason. I'll rework the patch. -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8 Gerrit-Change-Number: 43163 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 04 Aug 2026 14:39:25 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: fixeria <vyanitskiy(a)sysmocom.de> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
by fixeria 04 Aug '26

04 Aug '26

Attention is currently required from: pespin. fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email ) Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse() ...................................................................... Patch Set 2: (1 comment) File src/sccp2sua.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163/comment/48f47869_f1535… : PS1, Line 74: if (in_num_bytes * 2 >= out_digits_size) > shouldn't you account for one extra byte in this check in the case it's even number of bytes? becaus […] Note that the check is using `>=`, i.e. we accept the input only when `out_digits_size > in_num_bytes * 2`. Equivalent to `(in_num_bytes * 2 + 1) > out_digits_size`. Am I missing something here? -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8 Gerrit-Change-Number: 43163 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 04 Aug 2026 14:32:10 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
by pespin 04 Aug '26

04 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email ) Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse() ...................................................................... Patch Set 1: (1 comment) File src/sccp2sua.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163/comment/135e4dcb_8f836… : PS1, Line 74: if (in_num_bytes * 2 >= out_digits_size) shouldn't you account for one extra byte in this check in the case it's even number of bytes? because then you need one extra digit anyway. -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8 Gerrit-Change-Number: 43163 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Tue, 04 Aug 2026 14:13:40 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
by fixeria 04 Aug '26

04 Aug '26

Attention is currently required from: fixeria. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse() ...................................................................... sccp2sua: fix buffer overrun in osmo_isup_party_parse() Add an out_digits_size parameter and check that the caller-provided buffer is large enough to hold the generated digits plus the terminating NUL, instead of blindly writing up to 2 * in_num_bytes characters into it. Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8 Fixes: OS#7038 --- M src/sccp2sua.c M src/xua_internal.h M tests/xua/xua_test.c 3 files changed, 17 insertions(+), 8 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/63/43163/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8 Gerrit-Change-Number: 43163 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
by Jenkins Builder 04 Aug '26

04 Aug '26

Jenkins Builder has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email ) Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse() ...................................................................... Patch Set 1: (1 comment) File src/sccp2sua.c: Robot Comment from checkpatch (run ID ): https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163/comment/51b32e7e_0474f… : PS1, Line 72: /* The output buffer must be large enough to accomodate for 'accomodate' may be misspelled - perhaps 'accommodate'? -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8 Gerrit-Change-Number: 43163 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Comment-Date: Tue, 04 Aug 2026 14:08:11 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: fix buffer overrun in osmo_isup_party_parse()
by fixeria 04 Aug '26

04 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email ) Change subject: sccp2sua: fix buffer overrun in osmo_isup_party_parse() ...................................................................... sccp2sua: fix buffer overrun in osmo_isup_party_parse() Add an out_digits_size parameter and check that the caller-provided buffer is large enough to hold the generated digits plus the terminating NUL, instead of blindly writing up to 2 * in_num_bytes characters into it. Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8 Fixes: OS#7038 --- M src/sccp2sua.c M src/xua_internal.h M tests/xua/xua_test.c 3 files changed, 17 insertions(+), 8 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/63/43163/1 diff --git a/src/sccp2sua.c b/src/sccp2sua.c index 9ca1d7a..08f0776 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -57,17 +57,23 @@ /*! \brief Parse ISUP style address of BCD digets * \param[out] out_digits user-allocated buffer for ASCII digits + * \param[in] out_digits_size size of the user-allocated output buffer * \param[in] in BCD-encoded digits * \param[in] in_num_bytes Size of \ref in in bytes * \param[in] odd Odd (true) or even (false) number of digits - * \returns number of digits generated + * \returns number of digits generated; negative on error * */ -int osmo_isup_party_parse(char *out_digits, const uint8_t *in, - unsigned int in_num_bytes, bool odd) +int osmo_isup_party_parse(char *out_digits, size_t out_digits_size, + const uint8_t *in, unsigned int in_num_bytes, bool odd) { char *out = out_digits; unsigned int i; + /* The output buffer must be large enough to accomodate for + * double the amount of bytes in the input plus the '\0' symbol. */ + if (in_num_bytes * 2 >= out_digits_size) + return -E2BIG; + for (i = 0; i < in_num_bytes; i++) { *out_digits++ = osmo_bcd2char(in[i] & 0x0F); if (i+1 == in_num_bytes && odd) @@ -203,7 +209,8 @@ sca->global_title_indicator); return -EINVAL; } - rc = osmo_isup_party_parse(out->gt.digits, cur, (addr+addrlen-cur), odd); + rc = osmo_isup_party_parse(out->gt.digits, sizeof(out->gt.digits), + cur, (addr+addrlen-cur), odd); if (rc < 0) return rc; diff --git a/src/xua_internal.h b/src/xua_internal.h index 3857a72..5195b35 100644 --- a/src/xua_internal.h +++ b/src/xua_internal.h @@ -140,8 +140,8 @@ int ipa_tx_xua_as(struct osmo_ss7_as *as, struct xua_msg *xua); int ipa_rx_msg(struct osmo_ss7_asp *asp, struct msgb *msg, uint8_t sls); -int osmo_isup_party_parse(char *out_digits, const uint8_t *in, - unsigned int in_num_bytes, bool odd); +int osmo_isup_party_parse(char *out_digits, size_t out_digits_size, + const uint8_t *in, unsigned int in_num_bytes, bool odd); int osmo_sccp_addr_parse(struct osmo_sccp_addr *out, const uint8_t *addr, unsigned int addrlen); int osmo_sccp_addr_encode(struct msgb *msg, const struct osmo_sccp_addr *in); diff --git a/tests/xua/xua_test.c b/tests/xua/xua_test.c index 0759ff7..3fc04a6 100644 --- a/tests/xua/xua_test.c +++ b/tests/xua/xua_test.c @@ -42,12 +42,14 @@ char digits[23] = ""; int rc; - rc = osmo_isup_party_parse(digits, party0, ARRAY_SIZE(party0), false); + rc = osmo_isup_party_parse(digits, sizeof(digits), + party0, ARRAY_SIZE(party0), false); printf("digits='%s' (%d)\n", digits, rc); OSMO_ASSERT(rc == 8); OSMO_ASSERT(!strcmp(digits, "01234567")); - rc = osmo_isup_party_parse(digits, party0, ARRAY_SIZE(party0), true); + rc = osmo_isup_party_parse(digits, sizeof(digits), + party0, ARRAY_SIZE(party0), true); printf("digits='%s' (%d)\n", digits, rc); OSMO_ASSERT(rc == 7); OSMO_ASSERT(!strcmp(digits, "0123456")); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43163?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Iccfbcf22a719544399c7a524b293de9e1a040cf8 Gerrit-Change-Number: 43163 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in osmo-trx[master]: Transceiver52M: make TRXDv2 burst batching configurable
by pespin 04 Aug '26

04 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/osmo-trx/+/43117?usp=email ) Change subject: Transceiver52M: make TRXDv2 burst batching configurable ...................................................................... Patch Set 4: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-trx/+/43117?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-trx Gerrit-Branch: master Gerrit-Change-Id: I2f58f87d85de5254bae6d7a606dffcd0ad4069d5 Gerrit-Change-Number: 43117 Gerrit-PatchSet: 4 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Tue, 04 Aug 2026 11:46:13 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in osmo-trx[master]: Transceiver52M: migrate to libosmo-trx
by pespin 04 Aug '26

04 Aug '26

Attention is currently required from: Hoernchen, fixeria, tnt. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/osmo-trx/+/43115?usp=email ) Change subject: Transceiver52M: migrate to libosmo-trx ...................................................................... Patch Set 4: (6 comments) File Transceiver52M/Transceiver.cpp: https://gerrit.osmocom.org/c/osmo-trx/+/43115/comment/93cfb83a_cb93993b?usp… : PS4, Line 764: bi->rssi = (int8_t) lround(-(20.0 * log10(rxFullScale / avg) + rssi_offset)); so there's no nois calculation now? is it not used?BTW, I find this line quite difficult to read with all the operations, parenthesis and casts. Can you split it into a "float rssi = ..." and then "bi->rssi = (int8_t) lround(rssi);" or something like that? https://gerrit.osmocom.org/c/osmo-trx/+/43115/comment/4a4d1af4_cf487583?usp… : PS4, Line 801: bi->toa256 = (int16_t) lround(ebp.toa * 256.0); I wonder whether doing the multiplication before rounding is correct here. @tnt@246tNt.com and/or @ewild@sysmocom.de may want to review all these changes in this file. https://gerrit.osmocom.org/c/osmo-trx/+/43115/comment/1b0ebaf4_888b97a3?usp… : PS4, Line 815: bi->burst, float_soft_bit_to_sbit); Can you pass an inline static func to a std::transform?I also wonder whether the change from a loop in a function into a std:transform may hit somehow performance. Maybe it would be wise to do this change in a separate commit. https://gerrit.osmocom.org/c/osmo-trx/+/43115/comment/2a22bc1c_efb59edd?usp… : PS4, Line 1200: double noise_dbfs = 20.0 * log10(rxFullScale / mStates[chan].mNoiseLev) + rssi_offset; aah noise calculation happens here now, it's only needed for logging, fine. https://gerrit.osmocom.org/c/osmo-trx/+/43115/comment/cf1fcb2a_8cc67d66?usp… : PS4, Line 1244: msgb_free(msg); Since you are doing a synchrnonous write here: Why allocating and freeing a msgb every time? Can't you reuse it to avoid tons of mem allocating in the heap all the time? Something like msgb_trim() or whatever, and keep the msgb inside the Transceiver object. https://gerrit.osmocom.org/c/osmo-trx/+/43115/comment/046025b1_99c0d962?usp… : PS4, Line 1311: char command[64]; why was this changed? Looks like not really related to this patch or at least can be done in a separate patch? -- To view, visit https://gerrit.osmocom.org/c/osmo-trx/+/43115?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-trx Gerrit-Branch: master Gerrit-Change-Id: I458ec85c56e2101d073c8c35f11c147191c4ea0c Gerrit-Change-Number: 43115 Gerrit-PatchSet: 4 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: Hoernchen <ewild(a)sysmocom.de> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-CC: tnt <tnt(a)246tNt.com> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: tnt <tnt(a)246tNt.com> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Tue, 04 Aug 2026 11:44:42 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[L] Change in onomondo-ipa[master]: V1.2: Change of IpaEuiccDataRequest and results
by jolly 04 Aug '26

04 Aug '26

jolly has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/onomondo-ipa/+/43062?usp=email ) Change subject: V1.2: Change of IpaEuiccDataRequest and results ...................................................................... Set Ready For Review -- To view, visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43062?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-ipa Gerrit-Branch: master Gerrit-Change-Id: I411111c71787ce27615b6b66fc8b19488883d15b Gerrit-Change-Number: 43062 Gerrit-PatchSet: 3 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Comment-Date: Tue, 04 Aug 2026 11:39:28 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: No

1 0

[XS] Change in onomondo-ipa[master]: V1.2: Change tag of eimIdType in EimIdInfo
by jolly 04 Aug '26

04 Aug '26

Attention is currently required from: jolly. Hello Jenkins Builder, dexter, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43065?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: V1.2: Change tag of eimIdType in EimIdInfo ...................................................................... V1.2: Change tag of eimIdType in EimIdInfo Reference: SGP.23 Section 2.11.2.1 Related: SYS#8101 Change-Id: Id96353ef74ffe51aa7de4848832f32e8f58ab4df --- M asn1/SGP32Definitions.asn M src/ipa/libasn/EimIdInfo.c 2 files changed, 3 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-ipa refs/changes/65/43065/3 -- To view, visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43065?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: onomondo-ipa Gerrit-Branch: master Gerrit-Change-Id: Id96353ef74ffe51aa7de4848832f32e8f58ab4df Gerrit-Change-Number: 43065 Gerrit-PatchSet: 3 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu>

1 0