August 2026 - gerrit-log - lists.osmocom.org

[S] Change in libosmo-sigtran[master]: xua_snm: Validate Affected PCs follow configured formatting
by pespin 27 Aug '26

27 Aug '26

Attention is currently required from: laforge, pespin. Hello Jenkins Builder, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43419?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by laforge, Verified+1 by Jenkins Builder Change subject: xua_snm: Validate Affected PCs follow configured formatting ...................................................................... xua_snm: Validate Affected PCs follow configured formatting Avoid handling unexpected point codes being out of range regarding the point code formatting configured at the SS/ instance. In the case of DAUD, simply answer stating the unexpected PC is unavailable. Change-Id: I4cb19d11e0ca885dd6d717b5fb67be92bc01fd13 --- M include/osmocom/sigtran/osmo_ss7.h M src/ss7_instance.c M src/xua_snm.c 3 files changed, 41 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/19/43419/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43419?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I4cb19d11e0ca885dd6d717b5fb67be92bc01fd13 Gerrit-Change-Number: 43419 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-ttcn3-hacks[master]: testenv/README: automatic backtraces for coredumps
by osmith 27 Aug '26

27 Aug '26

osmith has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43420?usp=email ) Change subject: testenv/README: automatic backtraces for coredumps ...................................................................... testenv/README: automatic backtraces for coredumps Add documentation for this feature. Change-Id: I9b65bfb14853edb03ddb571867bb795bde9d495c --- M _testenv/README.md 1 file changed, 13 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/20/43420/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43420?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I9b65bfb14853edb03ddb571867bb795bde9d495c Gerrit-Change-Number: 43420 Gerrit-PatchSet: 2 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-CC: Jenkins Builder

1 0

[S] Change in osmo-ttcn3-hacks[master]: testenv/README: automatic backtraces for coredumps
by osmith 27 Aug '26

27 Aug '26

osmith has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43420?usp=email ) Change subject: testenv/README: automatic backtraces for coredumps ...................................................................... testenv/README: automatic backtraces for coredumps Add documentation for this feature. Change-Id: I9b65bfb14853edb03ddb571867bb795bde9d495c --- M _testenv/README.md 1 file changed, 13 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/20/43420/1 diff --git a/_testenv/README.md b/_testenv/README.md index 710c021..3496785 100644 --- a/_testenv/README.md +++ b/_testenv/README.md @@ -309,6 +309,19 @@ Switching between the versions is done either by setting a `titan_min` version in `testsrcdir.cfg`, or by using `-T` / `--titan-version`. +## Automatic backtraces for coredumps + +When your SUT crashes with a coredump, testenv automatically runs `gdb` to get +a backtrace, displays it in the output and writes it along with the other logs +into a `.backtrace` file. + +For this to work, you either need to have `systemd-coredump` set up, or +alternatively have a core pattern in `/proc/sys/kernel/core_pattern` starting +with `core`. + +Executables that do not start with a relevant prefix (`osmo-` or `open5gs-`) +get ignored, see `testenv.coredump.executable_is_relevant()`. + ## Troubleshooting ### Timeout waiting for RESET-ACK after sending RESET -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43420?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I9b65bfb14853edb03ddb571867bb795bde9d495c Gerrit-Change-Number: 43420 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: sccp_(long)ptr_part_consistent() Fix read buffer overflow i...
by pespin 27 Aug '26

27 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43415?usp=email ) Change subject: sccp2sua: sccp_(long)ptr_part_consistent() Fix read buffer overflow if ptr in tail ...................................................................... sccp2sua: sccp_(long)ptr_part_consistent() Fix read buffer overflow if ptr in tail Since we are dereferencing the otctet ptr, ptr must be at least 1 octet before the tail pointer, otherwise we are reading outside of msgb data boundaries. Take the chance to rewrite a bit the functions to use variables to store intermediate results, which makes it easier to follow the logic behind the calculations following the example diagram in ITU-T Q.713 Figure 2/Q.713. Related: OS#7075 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: Ibc5da4d03fff9bd83e85945c28dded3608611ab7 --- M src/sccp2sua.c 1 file changed, 19 insertions(+), 14 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, but someone else must approve pespin: Looks good to me, approved laforge: Looks good to me, but someone else must approve diff --git a/src/sccp2sua.c b/src/sccp2sua.c index b8030a6..5460732 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -475,21 +475,26 @@ static bool sccp_ptr_part_consistent(const struct msgb *msg, const uint8_t *ptr_addr) { const uint8_t *ptr; + uint8_t offs; + uint8_t len; /* check the address of the relative pointer is within msg */ - if (ptr_addr < msg->data || ptr_addr > msg->tail) { + if (ptr_addr < msg->data || ptr_addr >= msg->tail) { LOGP(DLSUA, LOGL_ERROR, "ptr_addr outside msg boundary\n"); return false; } - ptr = ptr_addr + *ptr_addr; - if (ptr > msg->tail) { + offs = *ptr_addr; + ptr = ptr_addr + offs; + if (ptr >= msg->tail) { LOGP(DLSUA, LOGL_ERROR, "ptr points outside msg boundary\n"); return false; } /* at destination of relative pointer is the length */ - if (ptr + 1 + *ptr > msg->tail) { + len = *ptr; + ptr++; + if (ptr + len > msg->tail) { LOGP(DLSUA, LOGL_ERROR, "ptr + len points outside msg boundary\n"); return false; } @@ -504,31 +509,31 @@ static bool sccp_longptr_part_consistent(const struct msgb *msg, const uint8_t *ptr_addr, bool len_is_long) { const uint8_t *ptr; - uint8_t offs; + uint16_t offs; + uint8_t len_size = len_is_long ? 2 : 1; uint16_t len; /* check the address of the relative pointer is within msg */ - if (ptr_addr < msg->data || ptr_addr > msg->tail) { + if (ptr_addr < msg->data || (ptr_addr + sizeof(uint16_t)) > msg->tail) { LOGP(DLSUA, LOGL_ERROR, "ptr_addr outside msg boundary\n"); return false; } + offs = osmo_load16le(ptr_addr); /* +1: Distance from MSB of pointer */ - ptr = ptr_addr + 1 + osmo_load16le(ptr_addr); - if (ptr > msg->tail) { + ptr = ptr_addr + 1 + offs; + if (ptr + len_size > msg->tail) { LOGP(DLSUA, LOGL_ERROR, "ptr %p points outside msg boundary %p\n", ptr, msg->tail); return false; } /* at destination of relative pointer is the length */ - if (len_is_long) { - offs = 2; + if (len_is_long) len = osmo_load16le(ptr); - } else { - offs = 1; + else len = *ptr; - } - if (ptr + offs + len > msg->tail) { + ptr += len_size; + if (ptr + len > msg->tail) { LOGP(DLSUA, LOGL_ERROR, "ptr + len points outside msg boundary\n"); return false; } -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43415?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ibc5da4d03fff9bd83e85945c28dded3608611ab7 Gerrit-Change-Number: 43415 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: sccp_to_xua_opt(): Fix read buffer overflow on truncated msg
by pespin 27 Aug '26

27 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43416?usp=email ) Change subject: sccp2sua: sccp_to_xua_opt(): Fix read buffer overflow on truncated msg ...................................................................... sccp2sua: sccp_to_xua_opt(): Fix read buffer overflow on truncated msg If a malformed/truncated message is received which lacks contents where the last byte of the (1-2 bytes) length Indicator should be, we'd be reading outside of the msgb data. See how in the switch statement the first offset is one less than the follow-up checks. Clean up the function by increasing the pointer on each state in order to fix it. Related: OS#7075 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I8f9a20b4eff4f4fd76f6c5a7e87ac0afb5921a8b --- M src/sccp2sua.c 1 file changed, 20 insertions(+), 18 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve pespin: Looks good to me, approved Jenkins Builder: Verified osmith: Looks good to me, but someone else must approve diff --git a/src/sccp2sua.c b/src/sccp2sua.c index 5460732..80c24ab 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -807,7 +807,7 @@ /* some bounds checking */ if (ptr_opt < msg->data) return NULL; - if (ptr_opt > msg->tail - (ptr_opt_is_long ? 2 : 1)) + if (ptr_opt + (ptr_opt_is_long ? 2 : 1) > msg->tail) return NULL; if (ptr_opt_is_long) @@ -831,34 +831,36 @@ enum sccp_parameter_name_codes opt_type = 0; /* dummy value not used */ while (oneopt < msg->tail) { - uint8_t opt_len; - uint16_t opt_len16; + uint8_t len_size; + uint16_t opt_len; + opt_type = oneopt[0]; + oneopt++; switch (opt_type) { case SCCP_PNC_END_OF_OPTIONAL: return xua; case SCCP_PNC_LONG_DATA: - /* two byte length field */ - if (oneopt + 2 > msg->tail) + /* two byte "Length Indicator" */ + len_size = 2; + if (oneopt + len_size > msg->tail) goto malformed; - opt_len16 = oneopt[1] << 8 | oneopt[2]; - if (oneopt + 3 + opt_len16 > msg->tail) - goto malformed; - xua_msg_add_sccp_opt(xua, opt_type, opt_len16, oneopt+3); - oneopt += 3 + opt_len16; + opt_len = oneopt[0] << 8 | oneopt[1]; + oneopt += len_size; break; default: - /* one byte length field */ - if (oneopt + 1 > msg->tail) + /* one byte "Length Indicator" */ + len_size = 1; + if (oneopt + len_size > msg->tail) goto malformed; - - opt_len = oneopt[1]; - if (oneopt + 2 + opt_len > msg->tail) - goto malformed; - xua_msg_add_sccp_opt(xua, opt_type, opt_len, oneopt+2); - oneopt += 2 + opt_len; + opt_len = oneopt[0]; + oneopt += len_size; } + + if (oneopt + opt_len > msg->tail) + goto malformed; + xua_msg_add_sccp_opt(xua, opt_type, opt_len, oneopt); + oneopt += opt_len; } LOGP(DLSUA, LOGL_ERROR, "Parameter %s not found\n", osmo_sccp_pnc_name(SCCP_PNC_END_OF_OPTIONAL)); return NULL; -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43416?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I8f9a20b4eff4f4fd76f6c5a7e87ac0afb5921a8b Gerrit-Change-Number: 43416 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: osmo_sccp_addr_parse(): Fix read buffer overflow
by pespin 27 Aug '26

27 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43417?usp=email ) Change subject: sccp2sua: osmo_sccp_addr_parse(): Fix read buffer overflow ...................................................................... sccp2sua: osmo_sccp_addr_parse(): Fix read buffer overflow The function was not validating reads passed the input buffer length. Related: OS#7077 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I1feabda052dc7a78b7d1d146aeb684e763923f74 --- M src/sccp2sua.c 1 file changed, 18 insertions(+), 2 deletions(-) Approvals: pespin: Looks good to me, approved laforge: Looks good to me, but someone else must approve osmith: Looks good to me, but someone else must approve Jenkins Builder: Verified diff --git a/src/sccp2sua.c b/src/sccp2sua.c index 80c24ab..84e06df 100644 --- a/src/sccp2sua.c +++ b/src/sccp2sua.c @@ -115,16 +115,20 @@ * \returns 0 in case of success, negative on error * According to Q.713/3.4 and RFC3868/3.10.2 */ int osmo_sccp_addr_parse(struct osmo_sccp_addr *out, - const uint8_t *addr, unsigned int addrlen) + const uint8_t *addr, unsigned int addrlen) { struct sccp_called_party_address *sca; uint8_t *cur; + const uint8_t *tail = addr + addrlen; uint8_t encoding; bool odd; int rc; memset(out, 0, sizeof(*out)); + if (addrlen < sizeof(struct sccp_called_party_address)) + return -1; + sca = (struct sccp_called_party_address *) addr; cur = sca->data; @@ -134,6 +138,8 @@ out->ri = OSMO_SCCP_RI_GT; if (sca->point_code_indicator) { + if (cur + 2 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_PC; out->pc = (uint16_t) (cur[1] & 0x3f) << 8; out->pc |= cur[0]; @@ -141,6 +147,8 @@ } if (sca->ssn_indicator) { + if (cur + 1 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_SSN; out->ssn = *cur; cur += 1; @@ -151,6 +159,8 @@ out->gt.gti = OSMO_SCCP_GTI_NO_GT; return 0; case SCCP_TITLE_IND_NATURE_ONLY: + if (cur + 1 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_GT; out->gt.gti = OSMO_SCCP_GTI_NAI_ONLY; out->gt.nai = *cur & 0x7f; @@ -160,6 +170,8 @@ odd = false; break; case SCCP_TITLE_IND_TRANSLATION_ONLY: + if (cur + 1 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_GT; out->gt.gti = OSMO_SCCP_GTI_TT_ONLY; out->gt.tt = *cur++; @@ -167,6 +179,8 @@ LOGP(DLSUA, LOGL_ERROR, "Unsupported national GTI %u\n", sca->global_title_indicator); return -EINVAL; case SCCP_TITLE_IND_TRANS_NUM_ENC: + if (cur + 2 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_GT; out->gt.gti = OSMO_SCCP_GTI_TT_NPL_ENC; out->gt.tt = *cur++; @@ -185,6 +199,8 @@ } break; case SCCP_TITLE_IND_TRANS_NUM_ENC_NATURE: + if (cur + 3 > tail) + return -1; out->presence |= OSMO_SCCP_ADDR_T_GT; out->gt.gti = OSMO_SCCP_GTI_TT_NPL_ENC_NAI; out->gt.tt = *cur++; @@ -210,7 +226,7 @@ return -EINVAL; } rc = osmo_isup_party_parse(out->gt.digits, sizeof(out->gt.digits), - cur, (addr+addrlen-cur), odd); + cur, (tail - cur), odd); if (rc < 0) return rc; -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43417?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I1feabda052dc7a78b7d1d146aeb684e763923f74 Gerrit-Change-Number: 43417 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: xua_snm: Trim received Affected PC Mask to configured PC width
by pespin 27 Aug '26

27 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43418?usp=email ) Change subject: xua_snm: Trim received Affected PC Mask to configured PC width ...................................................................... xua_snm: Trim received Affected PC Mask to configured PC width The mask byte in the Affected PCs IE was so far directly controlled by the peer sending the message to us. As a result, values much bigger than expected (>14 in ITU and >24 in ANSI) were being used as is, ending up in incorrect bitmasks being generated and in turn resulting in potential endless loops and memory allocation to fullfill up to ~2^30 combinations. Related: OS#7078 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: Ie178ff4b9fcbab16ca9d13b96fd689c4a57e8023 --- M src/xua_snm.c 1 file changed, 21 insertions(+), 4 deletions(-) Approvals: pespin: Looks good to me, approved Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve osmith: Looks good to me, but someone else must approve diff --git a/src/xua_snm.c b/src/xua_snm.c index 2abc42e..6befecc 100644 --- a/src/xua_snm.c +++ b/src/xua_snm.c @@ -48,6 +48,20 @@ osmo_static_assert(M3UA_IEI_ROUTE_CTX == SUA_IEI_ROUTE_CTX, _sa_rctx); osmo_static_assert(M3UA_IEI_INFO_STRING == SUA_IEI_INFO_STRING, _sa_inf_str); +/* Get "Mask" field from M3UA/SUA "Affected Point Code" IE and trim it to subset of + * Point Codes available in this instance. + * This prevents creating incorrect bitmasks and ending up in long loops based on peer + * inputting unexpected big values (ie. >14 on ITU and >24 on ANSI). + */ +static uint8_t mask_from_affected_pc(const struct osmo_ss7_instance *s7i, uint8_t aff_pc) +{ + const uint8_t pc_width = osmo_ss7_pc_width(&s7i->cfg.pc_fmt); + uint8_t mask = aff_pc >> 24; + if (mask > pc_width) + return pc_width; + return mask; +} + static const char *format_affected_pcs_c(void *ctx, const struct osmo_ss7_instance *s7i, const struct xua_msg_part *ie_aff_pc) { @@ -60,6 +74,7 @@ uint32_t _aff_pc = ntohl(aff_pc[i]); uint32_t pc = _aff_pc & 0xffffff; uint8_t mask = _aff_pc >> 24; + /* No need to call mask_from_affected_pc() here, we want to print what we actually received. */ /* append point code + mask */ out = talloc_asprintf_append(out, "%s%s/%u", i == 0 ? "" : ", ", @@ -144,7 +159,7 @@ * see RFC 4666 3.4.1 */ uint32_t _aff_pc = ntohl(aff_pc[i]); uint32_t pc = _aff_pc & 0xffffff; - uint8_t mask = _aff_pc >> 24; + uint8_t mask = mask_from_affected_pc(s7i, _aff_pc); if (!mask) { if (available) @@ -200,12 +215,14 @@ const uint32_t *aff_pc, unsigned int num_aff_pc, bool available) { + const struct osmo_ss7_instance *s7i = as->inst; + for (unsigned int i = 0; i < num_aff_pc; i++) { /* 32bit "Affected Point Code" consists of a 7-bit mask followed by 14/16/24-bit SS7 PC, * see RFC 4666 3.4.1 */ uint32_t _aff_pc = ntohl(aff_pc[i]); uint32_t pc = _aff_pc & 0xffffff; - uint8_t mask = _aff_pc >> 24; + uint8_t mask = mask_from_affected_pc(s7i, _aff_pc); if (!mask) { xua_snm_srm_pc_available_single(as, pc, available); @@ -349,7 +366,7 @@ * see RFC 4666 3.4.1 */ uint32_t _aff_pc = ntohl(aff_pc[i]); uint32_t pc = _aff_pc & 0xffffff; - uint8_t mask = _aff_pc >> 24; + uint8_t mask = mask_from_affected_pc(s7i, _aff_pc); if (!mask) { mtp_status_ind_up_to_all_users(s7i, pc, MTP_UNAVAIL_C_CONGESTED, @@ -430,7 +447,7 @@ for (i = 0; i < num_aff_pc; i++) { uint32_t _aff_pc = ntohl(aff_pc[i]); uint32_t pc = _aff_pc & 0xffffff; - uint8_t mask = _aff_pc >> 24; + uint8_t mask = mask_from_affected_pc(s7i, _aff_pc); bool is_available; if (mask == 0) { -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43418?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ie178ff4b9fcbab16ca9d13b96fd689c4a57e8023 Gerrit-Change-Number: 43418 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: sccp_(long)ptr_part_consistent() Fix read buffer overflow i...
by pespin 27 Aug '26

27 Aug '26

pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43415?usp=email ) Change subject: sccp2sua: sccp_(long)ptr_part_consistent() Fix read buffer overflow if ptr in tail ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43415?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ibc5da4d03fff9bd83e85945c28dded3608611ab7 Gerrit-Change-Number: 43415 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 08:14:50 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: sccp_to_xua_opt(): Fix read buffer overflow on truncated msg
by pespin 27 Aug '26

27 Aug '26

pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43416?usp=email ) Change subject: sccp2sua: sccp_to_xua_opt(): Fix read buffer overflow on truncated msg ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43416?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I8f9a20b4eff4f4fd76f6c5a7e87ac0afb5921a8b Gerrit-Change-Number: 43416 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 08:14:47 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sccp2sua: osmo_sccp_addr_parse(): Fix read buffer overflow
by pespin 27 Aug '26

27 Aug '26

pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43417?usp=email ) Change subject: sccp2sua: osmo_sccp_addr_parse(): Fix read buffer overflow ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43417?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I1feabda052dc7a78b7d1d146aeb684e763923f74 Gerrit-Change-Number: 43417 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 27 Aug 2026 08:14:45 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026