August 2026 - gerrit-log - lists.osmocom.org

[M] Change in osmo-ttcn3-hacks[master]: IPA: Start (and stop) IPAd from test cases
by dexter 28 Aug '26

28 Aug '26

Attention is currently required from: jolly, laforge. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43268?usp=email ) Change subject: IPA: Start (and stop) IPAd from test cases ...................................................................... Patch Set 6: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43268?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I178f8e8750bcd8e1ddbe9a16c615be4bb3e64c1c Gerrit-Change-Number: 43268 Gerrit-PatchSet: 6 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Fri, 28 Aug 2026 09:53:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: xua_snm: constify xua_msg param in xua_snm_rx_*
by osmith 28 Aug '26

28 Aug '26

Attention is currently required from: laforge, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43225?usp=email ) Change subject: xua_snm: constify xua_msg param in xua_snm_rx_* ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43225?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I3e5844a6f0d40c1df3ae31955bb8b24d891d86b1 Gerrit-Change-Number: 43225 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 28 Aug 2026 09:12:37 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in osmo-ttcn3-hacks[master]: smf: Implement PFCP Sess Est and Sess Del procedures
by osmith 28 Aug '26

28 Aug '26

Attention is currently required from: fixeria, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43378?usp=email ) Change subject: smf: Implement PFCP Sess Est and Sess Del procedures ...................................................................... Patch Set 6: Code-Review+1 (1 comment) File library/PFCP_Templates.ttcn: https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43378/comment/b0fce240_5063… : PS6, Line 299: } indent with tabs as well to match the templates above and below? -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43378?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I661a1893a3f7c3659753c82b009398763a06a92d Gerrit-Change-Number: 43378 Gerrit-PatchSet: 6 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 28 Aug 2026 09:09:41 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[M] Change in onomondo-ipa[master]: V1.2: Rename internal structure names from "auto" to "immediate"
by jolly 28 Aug '26

28 Aug '26

jolly has abandoned this change. ( https://gerrit.osmocom.org/c/onomondo-ipa/+/43024?usp=email ) Change subject: V1.2: Rename internal structure names from "auto" to "immediate" ...................................................................... Abandoned -- To view, visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43024?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: abandon Gerrit-Project: onomondo-ipa Gerrit-Branch: master Gerrit-Change-Id: Iad212f9b3e4430d4eaa6d4afdac0e73009275dfb Gerrit-Change-Number: 43024 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in onomondo-ipa[master]: WIP: Add refreshFlag
by jolly 28 Aug '26

28 Aug '26

jolly has abandoned this change. ( https://gerrit.osmocom.org/c/onomondo-ipa/+/43026?usp=email ) Change subject: WIP: Add refreshFlag ...................................................................... Abandoned -- To view, visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43026?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: abandon Gerrit-Project: onomondo-ipa Gerrit-Branch: master Gerrit-Change-Id: I7d8f9182b675ca0851e00ef8d36201151f30178f Gerrit-Change-Number: 43026 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: xua_snm: constify xua_msg param in xua_snm_rx_*
by pespin 28 Aug '26

28 Aug '26

Attention is currently required from: laforge, osmith. Hello Jenkins Builder, laforge, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43225?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Code-Review+1 by osmith, Verified+1 by Jenkins Builder Change subject: xua_snm: constify xua_msg param in xua_snm_rx_* ...................................................................... xua_snm: constify xua_msg param in xua_snm_rx_* There's no need to allocate talloc tons of times in format_affected_pcs(), which morever requrire the xua_msg pointer to be writable. Change-Id: I3e5844a6f0d40c1df3ae31955bb8b24d891d86b1 --- M src/xua_internal.h M src/xua_snm.c 2 files changed, 24 insertions(+), 21 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/25/43225/3 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43225?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I3e5844a6f0d40c1df3ae31955bb8b24d891d86b1 Gerrit-Change-Number: 43225 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org>

1 0

[M] Change in libosmo-sigtran[master]: xUA: Handle rx multiple Routing Context in SNM messages
by pespin 28 Aug '26

28 Aug '26

Attention is currently required from: laforge, osmith. Hello Jenkins Builder, laforge, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43226?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Code-Review+1 by osmith, Verified+1 by Jenkins Builder Change subject: xUA: Handle rx multiple Routing Context in SNM messages ...................................................................... xUA: Handle rx multiple Routing Context in SNM messages All those messages can contain multiple routing contexts inside the Routing Context IE according to both M3UA and SUA specs. Make sure all the Routing Contexts are validated and processed. Change-Id: I9ef1e343e95961d497f55e4a512068d3e7585a0c --- M src/m3ua.c M src/sua.c M src/xua_internal.h M src/xua_shared.c M src/xua_snm.c 5 files changed, 167 insertions(+), 72 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/26/43226/3 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43226?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9ef1e343e95961d497f55e4a512068d3e7585a0c Gerrit-Change-Number: 43226 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org>

1 0

[S] Change in onomondo-ipa[master]: Update README.md related to the current command line parameters
by dexter 28 Aug '26

28 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/onomondo-ipa/+/43403?usp=email ) Change subject: Update README.md related to the current command line parameters ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-ipa/+/43403?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-ipa Gerrit-Branch: master Gerrit-Change-Id: I66b89db33676139c8746eb1f94133e14af6e1485 Gerrit-Change-Number: 43403 Gerrit-PatchSet: 3 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Fri, 28 Aug 2026 08:34:07 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: sccp_to_xua_*(): propagate failure of sccp_addr_to_sua_ptr()
by pespin 28 Aug '26

28 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43425?usp=email ) Change subject: sccp2sua: sccp_to_xua_*(): propagate failure of sccp_addr_to_sua_ptr() ...................................................................... sccp2sua: sccp_to_xua_*(): propagate failure of sccp_addr_to_sua_ptr() Until now, if osmo_sccp_addr_parse() failed on some address, the failure was not propagated and the address was silently discarded when building the message. Instead, better fail the conversion. Change-Id: I44612fb0ea0728fab3147cf0eefcee17f96b29fa --- M src/sccp2sua.c 1 file changed, 26 insertions(+), 13 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, approved laforge: Looks good to me, but someone else must approve diff --git a/src/sccp2sua.c b/src/sccp2sua.c index 910ed84..bbca988 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -1173,7 +1173,8 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, &req->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &req->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &req->variable_called, false) < 0) + return NULL; /* Optional Part */ return sccp_to_xua_opt(msg, &req->optional_start, false, xua); } @@ -1382,10 +1383,12 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, &udt->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &udt->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &udt->variable_called, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &udt->variable_calling)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &udt->variable_calling, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &udt->variable_calling, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &udt->variable_data)) return NULL; sccp_data_to_sua_ptr(xua, SUA_IEI_DATA, &udt->variable_data); @@ -1436,10 +1439,12 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, &xudt->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &xudt->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &xudt->variable_called, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &xudt->variable_calling)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &xudt->variable_calling, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &xudt->variable_calling, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &xudt->variable_data)) return NULL; sccp_data_to_sua_ptr(xua, SUA_IEI_DATA, &xudt->variable_data); @@ -1486,10 +1491,12 @@ /* Variable Part */ if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludt->variable_called, false)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, (uint8_t *)&ludt->variable_called, true); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, (uint8_t *)&ludt->variable_called, true) < 0) + return NULL; if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludt->variable_calling, false)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, (uint8_t *)&ludt->variable_calling, true); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, (uint8_t *)&ludt->variable_calling, true) < 0) + return NULL; if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludt->variable_data, true)) return NULL; sccp_longdata_to_sua_ptr(xua, SUA_IEI_DATA, (uint8_t *)&ludt->variable_data); @@ -1528,10 +1535,12 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, &udts->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &udts->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &udts->variable_called, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &udts->variable_calling)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &udts->variable_calling, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &udts->variable_calling, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &udts->variable_data)) return NULL; sccp_data_to_sua_ptr(xua, SUA_IEI_DATA, &udts->variable_data); @@ -1583,10 +1592,12 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, (uint8_t *)&xudts->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &xudts->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &xudts->variable_called, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, (uint8_t *)&xudts->variable_calling)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &xudts->variable_calling, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &xudts->variable_calling, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, (uint8_t *)&xudts->variable_data)) return NULL; sccp_data_to_sua_ptr(xua, SUA_IEI_DATA, &xudts->variable_data); @@ -1626,10 +1637,12 @@ /* Variable Part */ if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludts->variable_called, false)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, (uint8_t *)&ludts->variable_called, true); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, (uint8_t *)&ludts->variable_called, true) < 0) + return NULL; if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludts->variable_calling, false)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, (uint8_t *)&ludts->variable_calling, true); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, (uint8_t *)&ludts->variable_calling, true) < 0) + return NULL; if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludts->variable_data, true)) return NULL; sccp_longdata_to_sua_ptr(xua, SUA_IEI_DATA, (uint8_t *)&ludts->variable_data); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43425?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I44612fb0ea0728fab3147cf0eefcee17f96b29fa Gerrit-Change-Number: 43425 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: sccp_to_xua_*(): Fix potential read buffer overflow
by pespin 28 Aug '26

28 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43424?usp=email ) Change subject: sccp2sua: sccp_to_xua_*(): Fix potential read buffer overflow ...................................................................... sccp2sua: sccp_to_xua_*(): Fix potential read buffer overflow All the sccp_to_xua_*() functions were lacking proper input length validation to make sure already the header and pointer tables were available in the input buffer. Related: OS#7080 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I310c9b65625aef227100cbc37709dc63fc4e7f8a --- M src/sccp2sua.c 1 file changed, 42 insertions(+), 0 deletions(-) Approvals: osmith: Looks good to me, approved Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve diff --git a/src/sccp2sua.c b/src/sccp2sua.c index 84e06df..910ed84 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -1164,6 +1164,9 @@ { struct sccp_connection_request *req = (struct sccp_connection_request *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*req)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, req->proto_class); xua_msg_add_u32(xua, SUA_IEI_SRC_REF, load_24be(&req->source_local_reference)); @@ -1200,6 +1203,9 @@ { struct sccp_connection_confirm *cnf = (struct sccp_connection_confirm *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*cnf)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, cnf->proto_class); xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&cnf->destination_local_reference)); @@ -1233,6 +1239,9 @@ { const struct sccp_connection_refused *ref = (const struct sccp_connection_refused *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*ref)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&ref->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_REFUSAL | ref->cause); @@ -1262,6 +1271,9 @@ { const struct sccp_connection_released *rlsd = (const struct sccp_connection_released *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*rlsd)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&rlsd->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_SRC_REF, load_24be(&rlsd->source_local_reference)); @@ -1296,6 +1308,9 @@ const struct sccp_connection_release_complete *rlc; rlc = (const struct sccp_connection_release_complete *) msg->l2h; + if (msgb_l2len(msg) < sizeof(*rlc)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&rlc->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_SRC_REF, load_24be(&rlc->source_local_reference)); @@ -1324,6 +1339,9 @@ { const struct sccp_data_form1 *dt1 = (const struct sccp_data_form1 *) msg->l2h; + if (msgb_l2len(msg) < sizeof(*dt1)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&dt1->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_SEGMENTATION, dt1->segmenting); @@ -1356,6 +1374,9 @@ { const struct sccp_data_unitdata *udt = (const struct sccp_data_unitdata *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*udt)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, udt->proto_class); /* Variable Part */ @@ -1406,6 +1427,9 @@ { const struct sccp_data_ext_unitdata *xudt = (const struct sccp_data_ext_unitdata *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*xudt)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, xudt->proto_class); xua_msg_add_u32(xua, SUA_IEI_S7_HOP_CTR, xudt->hop_counter); @@ -1453,6 +1477,9 @@ { struct sccp_data_long_unitdata *ludt = (struct sccp_data_long_unitdata *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*ludt)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, ludt->proto_class); xua_msg_add_u32(xua, SUA_IEI_S7_HOP_CTR, ludt->hop_counter); @@ -1493,6 +1520,9 @@ const struct sccp_data_unitdata_service *udts; udts = (const struct sccp_data_unitdata_service *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*udts)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_RETURN | udts->return_cause); /* Variable Part */ @@ -1544,6 +1574,9 @@ const struct sccp_data_ext_unitdata_service *xudts; xudts = (const struct sccp_data_ext_unitdata_service *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*xudts)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_RETURN | xudts->return_cause); xua_msg_add_u32(xua, SUA_IEI_S7_HOP_CTR, xudts->hop_counter); @@ -1584,6 +1617,9 @@ const struct sccp_data_long_unitdata_service *ludts; ludts = (const struct sccp_data_long_unitdata_service *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*ludts)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_RETURN | ludts->return_cause); xua_msg_add_u32(xua, SUA_IEI_S7_HOP_CTR, ludts->hop_counter); @@ -1623,6 +1659,9 @@ { const struct sccp_data_it *it = (const struct sccp_data_it *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*it)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, it->proto_class); xua_msg_add_u32(xua, SUA_IEI_SRC_REF, load_24be(&it->source_local_reference)); @@ -1662,6 +1701,9 @@ { const struct sccp_proto_err *err = (const struct sccp_proto_err *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*err)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&err->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_ERROR | err->error_cause); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43424?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I310c9b65625aef227100cbc37709dc63fc4e7f8a Gerrit-Change-Number: 43424 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026