August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in libosmo-sigtran[master]: sua: sua_addr_parse_part(): Log subpart where parse failed
by laforge 27 Aug '26

27 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43423?usp=email ) Change subject: sua: sua_addr_parse_part(): Log subpart where parse failed ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43423?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Id33b74f10cb617d94a404b509240a46f6d11324b Gerrit-Change-Number: 43423 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 12:04:41 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: sua: sua_addr_parse_part(): Propagate failure from sua_parse_gt()
by laforge 27 Aug '26

27 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43422?usp=email ) Change subject: sua: sua_addr_parse_part(): Propagate failure from sua_parse_gt() ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43422?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ia9d33d313b272e5b230be68eccb8e14ff739d9a4 Gerrit-Change-Number: 43422 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 12:04:21 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: sua: sua_addr_parse_part(): Fix potential read buffer overflow
by laforge 27 Aug '26

27 Aug '26

Attention is currently required from: fixeria, pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43421?usp=email ) Change subject: sua: sua_addr_parse_part(): Fix potential read buffer overflow ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43421?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I12fbdfc37bfbf6cf9ba18942eb0ec43c9d1349fe Gerrit-Change-Number: 43421 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 12:03:53 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: sccp_to_xua_*(): Fix potential read buffer overflow
by pespin 27 Aug '26

27 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43424?usp=email ) Change subject: sccp2sua: sccp_to_xua_*(): Fix potential read buffer overflow ...................................................................... sccp2sua: sccp_to_xua_*(): Fix potential read buffer overflow All the sccp_to_xua_*() functions were lacking proper input length validation to make sure already the header and pointer tables were available in the input buffer. Related: OS#7080 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I310c9b65625aef227100cbc37709dc63fc4e7f8a --- M src/sccp2sua.c 1 file changed, 42 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/24/43424/1 diff --git a/src/sccp2sua.c b/src/sccp2sua.c index 84e06df..910ed84 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -1164,6 +1164,9 @@ { struct sccp_connection_request *req = (struct sccp_connection_request *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*req)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, req->proto_class); xua_msg_add_u32(xua, SUA_IEI_SRC_REF, load_24be(&req->source_local_reference)); @@ -1200,6 +1203,9 @@ { struct sccp_connection_confirm *cnf = (struct sccp_connection_confirm *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*cnf)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, cnf->proto_class); xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&cnf->destination_local_reference)); @@ -1233,6 +1239,9 @@ { const struct sccp_connection_refused *ref = (const struct sccp_connection_refused *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*ref)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&ref->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_REFUSAL | ref->cause); @@ -1262,6 +1271,9 @@ { const struct sccp_connection_released *rlsd = (const struct sccp_connection_released *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*rlsd)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&rlsd->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_SRC_REF, load_24be(&rlsd->source_local_reference)); @@ -1296,6 +1308,9 @@ const struct sccp_connection_release_complete *rlc; rlc = (const struct sccp_connection_release_complete *) msg->l2h; + if (msgb_l2len(msg) < sizeof(*rlc)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&rlc->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_SRC_REF, load_24be(&rlc->source_local_reference)); @@ -1324,6 +1339,9 @@ { const struct sccp_data_form1 *dt1 = (const struct sccp_data_form1 *) msg->l2h; + if (msgb_l2len(msg) < sizeof(*dt1)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&dt1->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_SEGMENTATION, dt1->segmenting); @@ -1356,6 +1374,9 @@ { const struct sccp_data_unitdata *udt = (const struct sccp_data_unitdata *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*udt)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, udt->proto_class); /* Variable Part */ @@ -1406,6 +1427,9 @@ { const struct sccp_data_ext_unitdata *xudt = (const struct sccp_data_ext_unitdata *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*xudt)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, xudt->proto_class); xua_msg_add_u32(xua, SUA_IEI_S7_HOP_CTR, xudt->hop_counter); @@ -1453,6 +1477,9 @@ { struct sccp_data_long_unitdata *ludt = (struct sccp_data_long_unitdata *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*ludt)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, ludt->proto_class); xua_msg_add_u32(xua, SUA_IEI_S7_HOP_CTR, ludt->hop_counter); @@ -1493,6 +1520,9 @@ const struct sccp_data_unitdata_service *udts; udts = (const struct sccp_data_unitdata_service *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*udts)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_RETURN | udts->return_cause); /* Variable Part */ @@ -1544,6 +1574,9 @@ const struct sccp_data_ext_unitdata_service *xudts; xudts = (const struct sccp_data_ext_unitdata_service *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*xudts)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_RETURN | xudts->return_cause); xua_msg_add_u32(xua, SUA_IEI_S7_HOP_CTR, xudts->hop_counter); @@ -1584,6 +1617,9 @@ const struct sccp_data_long_unitdata_service *ludts; ludts = (const struct sccp_data_long_unitdata_service *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*ludts)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_RETURN | ludts->return_cause); xua_msg_add_u32(xua, SUA_IEI_S7_HOP_CTR, ludts->hop_counter); @@ -1623,6 +1659,9 @@ { const struct sccp_data_it *it = (const struct sccp_data_it *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*it)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_PROTO_CLASS, it->proto_class); xua_msg_add_u32(xua, SUA_IEI_SRC_REF, load_24be(&it->source_local_reference)); @@ -1662,6 +1701,9 @@ { const struct sccp_proto_err *err = (const struct sccp_proto_err *)msg->l2h; + if (msgb_l2len(msg) < sizeof(*err)) + return NULL; + /* Fixed Part */ xua_msg_add_u32(xua, SUA_IEI_DEST_REF, load_24be(&err->destination_local_reference)); xua_msg_add_u32(xua, SUA_IEI_CAUSE, SUA_CAUSE_T_ERROR | err->error_cause); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43424?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I310c9b65625aef227100cbc37709dc63fc4e7f8a Gerrit-Change-Number: 43424 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: sccp_to_xua_*(): propagate failure of sccp_addr_to_sua_ptr()
by pespin 27 Aug '26

27 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43425?usp=email ) Change subject: sccp2sua: sccp_to_xua_*(): propagate failure of sccp_addr_to_sua_ptr() ...................................................................... sccp2sua: sccp_to_xua_*(): propagate failure of sccp_addr_to_sua_ptr() Until now, if osmo_sccp_addr_parse() failed on some address, the failure was not propagated and the address was silently discarded when building the message. Instead, better fail the conversion. Change-Id: I44612fb0ea0728fab3147cf0eefcee17f96b29fa --- M src/sccp2sua.c 1 file changed, 26 insertions(+), 13 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/25/43425/1 diff --git a/src/sccp2sua.c b/src/sccp2sua.c index 910ed84..bbca988 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -1173,7 +1173,8 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, &req->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &req->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &req->variable_called, false) < 0) + return NULL; /* Optional Part */ return sccp_to_xua_opt(msg, &req->optional_start, false, xua); } @@ -1382,10 +1383,12 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, &udt->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &udt->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &udt->variable_called, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &udt->variable_calling)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &udt->variable_calling, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &udt->variable_calling, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &udt->variable_data)) return NULL; sccp_data_to_sua_ptr(xua, SUA_IEI_DATA, &udt->variable_data); @@ -1436,10 +1439,12 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, &xudt->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &xudt->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &xudt->variable_called, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &xudt->variable_calling)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &xudt->variable_calling, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &xudt->variable_calling, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &xudt->variable_data)) return NULL; sccp_data_to_sua_ptr(xua, SUA_IEI_DATA, &xudt->variable_data); @@ -1486,10 +1491,12 @@ /* Variable Part */ if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludt->variable_called, false)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, (uint8_t *)&ludt->variable_called, true); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, (uint8_t *)&ludt->variable_called, true) < 0) + return NULL; if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludt->variable_calling, false)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, (uint8_t *)&ludt->variable_calling, true); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, (uint8_t *)&ludt->variable_calling, true) < 0) + return NULL; if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludt->variable_data, true)) return NULL; sccp_longdata_to_sua_ptr(xua, SUA_IEI_DATA, (uint8_t *)&ludt->variable_data); @@ -1528,10 +1535,12 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, &udts->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &udts->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &udts->variable_called, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &udts->variable_calling)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &udts->variable_calling, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &udts->variable_calling, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, &udts->variable_data)) return NULL; sccp_data_to_sua_ptr(xua, SUA_IEI_DATA, &udts->variable_data); @@ -1583,10 +1592,12 @@ /* Variable Part */ if (!sccp_ptr_part_consistent(msg, (uint8_t *)&xudts->variable_called)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &xudts->variable_called, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, &xudts->variable_called, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, (uint8_t *)&xudts->variable_calling)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &xudts->variable_calling, false); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, &xudts->variable_calling, false) < 0) + return NULL; if (!sccp_ptr_part_consistent(msg, (uint8_t *)&xudts->variable_data)) return NULL; sccp_data_to_sua_ptr(xua, SUA_IEI_DATA, &xudts->variable_data); @@ -1626,10 +1637,12 @@ /* Variable Part */ if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludts->variable_called, false)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, (uint8_t *)&ludts->variable_called, true); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_DEST_ADDR, (uint8_t *)&ludts->variable_called, true) < 0) + return NULL; if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludts->variable_calling, false)) return NULL; - sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, (uint8_t *)&ludts->variable_calling, true); + if (sccp_addr_to_sua_ptr(xua, SUA_IEI_SRC_ADDR, (uint8_t *)&ludts->variable_calling, true) < 0) + return NULL; if (!sccp_longptr_part_consistent(msg, (uint8_t *)&ludts->variable_data, true)) return NULL; sccp_longdata_to_sua_ptr(xua, SUA_IEI_DATA, (uint8_t *)&ludts->variable_data); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43425?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I44612fb0ea0728fab3147cf0eefcee17f96b29fa Gerrit-Change-Number: 43425 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in simtrace2[master]: firmware: Implement debug command via USB control vendor class
by lynxis lazus 27 Aug '26

27 Aug '26

Attention is currently required from: laforge. lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/simtrace2/+/43005?usp=email ) Change subject: firmware: Implement debug command via USB control vendor class ...................................................................... Patch Set 12: (1 comment) Patchset: PS12: > ping? Is it difficult to fix the linter issues, or is there a problem with the linter? This has bee […] IMHO: the linter is not a blocker to merge it. I'm following there the previous style. If we want to fix it, we should fix it in a separate commit.I'll do a final test with a simtrace2 and merge it afterwards. -- To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43005?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: simtrace2 Gerrit-Branch: master Gerrit-Change-Id: I1f4d29335eb0d2feef376b8ecdfe57a0162914d6 Gerrit-Change-Number: 43005 Gerrit-PatchSet: 12 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Thu, 27 Aug 2026 10:46:50 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in libosmo-sigtran[master]: sua: sua_addr_parse_part(): Log subpart where parse failed
by osmith 27 Aug '26

27 Aug '26

Attention is currently required from: pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43423?usp=email ) Change subject: sua: sua_addr_parse_part(): Log subpart where parse failed ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43423?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Id33b74f10cb617d94a404b509240a46f6d11324b Gerrit-Change-Number: 43423 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 10:28:17 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: sua: sua_addr_parse_part(): Propagate failure from sua_parse_gt()
by osmith 27 Aug '26

27 Aug '26

Attention is currently required from: pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43422?usp=email ) Change subject: sua: sua_addr_parse_part(): Propagate failure from sua_parse_gt() ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43422?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ia9d33d313b272e5b230be68eccb8e14ff739d9a4 Gerrit-Change-Number: 43422 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 10:28:03 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: sua: sua_addr_parse_part(): Fix potential read buffer overflow
by osmith 27 Aug '26

27 Aug '26

Attention is currently required from: fixeria, laforge, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43421?usp=email ) Change subject: sua: sua_addr_parse_part(): Fix potential read buffer overflow ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43421?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I12fbdfc37bfbf6cf9ba18942eb0ec43c9d1349fe Gerrit-Change-Number: 43421 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 10:27:27 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: sua: sua_addr_parse_part(): Propagate failure from sua_parse_gt()
by pespin 27 Aug '26

27 Aug '26

pespin has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43422?usp=email ) Change subject: sua: sua_addr_parse_part(): Propagate failure from sua_parse_gt() ...................................................................... sua: sua_addr_parse_part(): Propagate failure from sua_parse_gt() As a result, addresses with > 31 digits would be silently trimmed and accepted. Also, remove the par_datalen check, sua_parse_gt() already takes care of it. Change-Id: Ia9d33d313b272e5b230be68eccb8e14ff739d9a4 --- M src/sua.c 1 file changed, 1 insertion(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/22/43422/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43422?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ia9d33d313b272e5b230be68eccb8e14ff739d9a4 Gerrit-Change-Number: 43422 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-CC: Jenkins Builder

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026