Attention is currently required from: pespin.
osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43337?usp=email )
Change subject: Pass pdp_t to sgsn_pdp_ctx_alloc()
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43337?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-sgsn
Gerrit-Branch: pespin/rel-1.13.1
Gerrit-Change-Id: Ie7312039fc97f50d09f00661e7c156610f3304b8
Gerrit-Change-Number: 43337
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-CC: Jenkins Builder
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Thu, 20 Aug 2026 12:44:26 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Attention is currently required from: neels.
fixeria has posted comments on this change by neels. ( https://gerrit.osmocom.org/c/pysim/+/43290?usp=email )
Change subject: ts_31_102.py: EF_SUCI_Calc_Info(TransparentEF): fix len test
......................................................................
Patch Set 2: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/43290?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: Ia4e2356d0241d7a6ca399ba7e8be7f27ec836104
Gerrit-Change-Number: 43290
Gerrit-PatchSet: 2
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Comment-Date: Thu, 20 Aug 2026 12:44:23 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43342?usp=email )
Change subject: ranap: Avoid write buffer overflow on GTPv1U outter IPv6 addr
......................................................................
ranap: Avoid write buffer overflow on GTPv1U outter IPv6 addr
If an IPv6 address was passed by libgtp in pdp->lib->gsnru,
sgsn_pdp_ctx_iu_rab_activate() would write 16 bytes to an uint32_t
variable, overflowing it and writing further on the stack.
The proper extended fix can be found in osmo-sgsn.git master branch
commit 6fd7c8b7fb0be7f96de7e7c5b4d22c54642f383a, this is a "backport" for
it fixing the security issue (write buffer overflow) in a simple way,
since the code has changed quite a lot in master.
Change-Id: Id521fbc904f847952736e8d63f77a616f1f8e838
Related: OS#7060
Reported-By: Adam Bedard <adam.bedard(a)gmail.com>
---
M src/sgsn/gprs_ranap.c
1 file changed, 5 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/42/43342/1
diff --git a/src/sgsn/gprs_ranap.c b/src/sgsn/gprs_ranap.c
index 2ad663e..6f82850 100644
--- a/src/sgsn/gprs_ranap.c
+++ b/src/sgsn/gprs_ranap.c
@@ -236,6 +236,11 @@
use_x213_nsap = (uectx->rab_assign_addr_enc == RANAP_NSAP_ADDR_ENC_X213);
/* Get the IP address for ggsn user plane */
+ if (pdp->lib->gsnru.l != sizeof(ggsn_ip)) {
+ LOGPDPCTXP(LOGL_ERROR, pdp, "GSN-U address length %u unsupported\n",
+ pdp->lib->gsnru.l);
+ return -EINVAL;
+ }
memcpy(&ggsn_ip, pdp->lib->gsnru.v, pdp->lib->gsnru.l);
ggsn_ip = htonl(ggsn_ip);
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43342?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-sgsn
Gerrit-Branch: pespin/rel-1.13.1
Gerrit-Change-Id: Id521fbc904f847952736e8d63f77a616f1f8e838
Gerrit-Change-Number: 43342
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>