August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in libosmocore[master]: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()
by fixeria 19 Aug '26

19 Aug '26

fixeria has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email ) Change subject: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse() ...................................................................... gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse() The IPA CCM ID RESP TLV format uses a 16bit length field, and osmo_load16be() is used to read it, but t_len was declared as uint8_t, silently truncating any length above 255. Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99 Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: fixeria: Looks good to me, approved Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve pespin: Looks good to me, but someone else must approve diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index 50fa31f..3e631de 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -209,7 +209,7 @@ * \returns 0 on success; negative on error */ int ipa_ccm_id_resp_parse(struct tlv_parsed *dec, const uint8_t *buf, unsigned int len) { - uint8_t t_len; + uint16_t t_len; uint8_t t_tag; const uint8_t *cur = buf; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99 Gerrit-Change-Number: 43232 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}()
by fixeria 19 Aug '26

19 Aug '26

fixeria has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43235?usp=email ) Change subject: gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}() ...................................................................... gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}() Both Facility component parsers checked 'offset' against 'length' one (or two) bytes short of the index they went on to dereference, and parse_ss_invoke() never re-validated 'offset' after skipping the optional Linked ID, whose skip length is attacker-controlled. The same off-by-one on the operation-code path also let "length - offset - 3" underflow a uint16_t, handing parse_process_uss_req() a bogus, oversized length that bypassed its own bounds check and grew the over-read into a memcpy() into req->ussd_data/req->ussd_text. Tighten each guard to cover the index actually dereferenced, and re-check 'offset' against 'length' after the Linked ID skip and after the post-SEQUENCE-tag increment in parse_ss_return_result(). Change-Id: I59fe4df8045dbe1e2b9509330527408b84abf2e4 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Fixes: OS#7051 --- M src/gsm/gsm0480.c 1 file changed, 15 insertions(+), 6 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve pespin: Looks good to me, but someone else must approve Jenkins Builder: Verified fixeria: Looks good to me, approved diff --git a/src/gsm/gsm0480.c b/src/gsm/gsm0480.c index a8eac6b..5db5bed 100644 --- a/src/gsm/gsm0480.c +++ b/src/gsm/gsm0480.c @@ -548,17 +548,24 @@ offset = invoke_data[1] + 2; req->invoke_id = invoke_data[2]; - /* look ahead once */ - if (offset + 1 > length) + /* look ahead once: need invoke_data[offset] and, if it turns out to be + * the optional Linked ID tag, invoke_data[offset+1] as well */ + if (offset + 2 > length) return 0; /* optional part */ - if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) + if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) { offset += invoke_data[offset+1] + 2; /* skip over it */ + /* offset moved by an attacker-controlled amount: re-validate */ + if (offset >= length) + return 0; + } + /* mandatory part */ if (invoke_data[offset] == GSM0480_OPERATION_CODE) { - if (offset + 2 > length) + /* need invoke_data[offset+2] below, and length - offset - 3 must not underflow */ + if (offset + 3 > length) return 0; uint8_t operation_code = invoke_data[offset+2]; req->opcode = operation_code; @@ -624,10 +631,12 @@ if (rr_data[offset] != GSM_0480_SEQUENCE_TAG) return 0; - if (offset + 2 > length) + offset += 2; + + /* need rr_data[offset+2] below, and length - offset - 3 must not underflow */ + if (offset + 3 > length) return 0; - offset += 2; operation_code = rr_data[offset + 2]; req->opcode = operation_code; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43235?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I59fe4df8045dbe1e2b9509330527408b84abf2e4 Gerrit-Change-Number: 43235 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: Add log message for unexpected result in PIPEasp function
by dexter 19 Aug '26

19 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43267?usp=email ) Change subject: Add log message for unexpected result in PIPEasp function ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43267?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ic20f4b23050940348879512d6c8b78c1ae70e75d Gerrit-Change-Number: 43267 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:47:01 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmocore[master]: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()
by fixeria 19 Aug '26

19 Aug '26

Attention is currently required from: pespin. fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email ) Change subject: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse() ...................................................................... Patch Set 1: Code-Review+2 (1 comment) File src/gsm/ipa.c: https://gerrit.osmocom.org/c/libosmocore/+/43232/comment/2ba28f45_c9e70f94?… : PS1, Line 212: uint16_t t_len; > Waoh so ipa_ccm_id_resp_parse() has a 2 byte len and ipa_ccm_id_get_parse() has a 1 byte len? Yes. See also the payload format in doxygen comments above. For this function it's "16bit length value (length of payload *and tag*)". -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99 Gerrit-Change-Number: 43232 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:46:20 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-ttcn3-hacks[master]: Add start and stop functions to PIPEasp
by dexter 19 Aug '26

19 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43266?usp=email ) Change subject: Add start and stop functions to PIPEasp ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43266?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I5be804e5fa7b9a135cceaf07ac4157895a222b40 Gerrit-Change-Number: 43266 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:41:41 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[NoOp] Change in osmo-ttcn3-hacks[master]: IPAd: Update nvstate.bin to SGP.32 Version 1.2
by dexter 19 Aug '26

19 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42969?usp=email ) Change subject: IPAd: Update nvstate.bin to SGP.32 Version 1.2 ...................................................................... Patch Set 5: Code-Review-1 (1 comment) Patchset: PS5: This patch illustrates the problem with nvstate.bin quite well. If you use a prepared nvstate.bin you are forced to update it each time the format changes. It is better to generate the nvstate.bin automatically before the testsuite runs. -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42969?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I3d22980f5f8be546f0d80423b3bd80d197aa8872 Gerrit-Change-Number: 42969 Gerrit-PatchSet: 5 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:40:14 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[M] Change in osmo-ttcn3-hacks[master]: IPAd: Make tests work with testenv and current master of IPAd
by dexter 19 Aug '26

19 Aug '26

Attention is currently required from: jolly, osmith. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42967?usp=email ) Change subject: IPAd: Make tests work with testenv and current master of IPAd ...................................................................... Patch Set 5: Code-Review-1 (1 comment) Patchset: PS5: We still have the problem with the nvstate.bin here. This file should be generated dynamically. -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42967?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Id4abf15feb179b17594bd11c6e7089469684900c Gerrit-Change-Number: 42967 Gerrit-PatchSet: 5 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:38:07 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ttcn3-hacks[master]: Add close function to HTTP_Server_Emulation
by dexter 19 Aug '26

19 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42965?usp=email ) Change subject: Add close function to HTTP_Server_Emulation ...................................................................... Patch Set 5: Code-Review+2 (1 comment) File library/HTTP_Server_Emulation.ttcn: https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42965/comment/02467678_2508… : PS4, Line 125: inout HTTPMessage, Close; > I would give the close a separate line. […] (since this is a cosmetic thing only, let's keep it as it is to save some time.) -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42965?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Id09976800c7498a7173b5d8911fe545504cfa266 Gerrit-Change-Number: 42965 Gerrit-PatchSet: 5 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:36:34 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in osmo-ttcn3-hacks[master]: IPAd: Add eimTransactionId to TC_proc_indirect_prfle_dwnld
by dexter 19 Aug '26

19 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43279?usp=email ) Change subject: IPAd: Add eimTransactionId to TC_proc_indirect_prfle_dwnld ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43279?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I1b6370188a909dd2315215b6eff23c80d2b26c30 Gerrit-Change-Number: 43279 Gerrit-PatchSet: 2 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:29:06 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ttcn3-hacks[master]: IPAd: Add TERMINAL CAPABILITIES request (IoT Device Capabilites)
by dexter 19 Aug '26

19 Aug '26

Attention is currently required from: jolly, laforge. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42968?usp=email ) Change subject: IPAd: Add TERMINAL CAPABILITIES request (IoT Device Capabilites) ...................................................................... Patch Set 5: Code-Review+2 (1 comment) File ipad/IPAd_Tests.ttcn: https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42968/comment/6cc3e7d3_3556… : PS4, Line 323: f_vpcd_send(ts_VPCD_DATA('9000'O)); > Are you sure this would work in two steps? (see also my comments on the onomondo-ipa patchset) No it is one step only - looks good to me now. -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42968?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I0a6d8d6bb6eb0ee30e14afdb5e4ce37af0ae711e Gerrit-Change-Number: 42968 Gerrit-PatchSet: 5 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:24:27 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026