August 2026 - gerrit-log - lists.osmocom.org

[S] Change in osmo-msc[master]: sgs_iface: clean up code in function decode_mme_name
by dexter 15 Aug '26

15 Aug '26

Attention is currently required from: laforge, pespin. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email ) Change subject: sgs_iface: clean up code in function decode_mme_name ...................................................................... Patch Set 5: (3 comments) This change is ready for review. Patchset: PS5: I have revisited the patch. Now everything should be clear. File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/2092e30b_c28944a5?usp… : PS2, Line 178: > I'm also personally fine with accepting a non-3GPP FQDN there. […] I have now looked at everything again and now everything makes sense to me. I have updated the comments so that it is easier to understand. We basically just tolerate two different domain name formats with the same domain name in it. https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/ed1bf4cf_86294609?usp… : PS2, Line 204: OSMO_ASSERT(osmo_parse_mme_domain(&gummei, mme_fqdn) == 0); > Ah, no. Looks like a made a thinking mistake here. Let's forget about this. This path was indeed completely wrong. I just had a knot in my brain... -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 Gerrit-Change-Number: 43237 Gerrit-PatchSet: 5 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 16:25:24 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de> Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in osmo-ci[master]: jenkins-gerrit/comment_generate: fix 0 jobs msg
by fixeria 15 Aug '26

15 Aug '26

Attention is currently required from: osmith. fixeria has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43243?usp=email ) Change subject: jenkins-gerrit/comment_generate: fix 0 jobs msg ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43243?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I7289ce30492a84dedeac12bfc967d7c578f13790 Gerrit-Change-Number: 43243 Gerrit-PatchSet: 2 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 15:54:58 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmocore[master]: gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}()
by fixeria 15 Aug '26

15 Aug '26

fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43235?usp=email ) Change subject: gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}() ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43235?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I59fe4df8045dbe1e2b9509330527408b84abf2e4 Gerrit-Change-Number: 43235 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 15:54:01 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmocore[master]: gsm0808: fix buffer overflow in gsm0808_dec_encrypt_info()
by fixeria 15 Aug '26

15 Aug '26

fixeria has abandoned this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43244?usp=email ) Change subject: gsm0808: fix buffer overflow in gsm0808_dec_encrypt_info() ...................................................................... Abandoned https://gerrit.osmocom.org/c/libosmocore/+/43251 was merged instead. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43244?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: abandon Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I3140319c6ab5dabb2e356f5c59f6cb05542554cd Gerrit-Change-Number: 43244 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[S] Change in libosmocore[master]: gsm: Reject BSSMAP Encryption Information IE with key length != 8
by fixeria 15 Aug '26

15 Aug '26

fixeria has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email ) Change subject: gsm: Reject BSSMAP Encryption Information IE with key length != 8 ...................................................................... Patch Set 3: (1 comment) Patchset: PS3: > I'm sorry, I was actually unaware of that patch, I must have marked as read on my email client someh […] No problem. It was reported via email to @laforge@osmocom.org, who forwarded the email to me. The reporter is also eager to get a CVE - what a demand! :) Now I need to tell them that the problem has already been fixed. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9fd70875f35cebb923278869e1260c5bf3047439 Gerrit-Change-Number: 43251 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 15:53:08 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: pespin <pespin(a)sysmocom.de> Comment-In-Reply-To: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in osmo-msc[master]: smpp: Fix potential write buffer overflow on sms->user_data
by pespin 15 Aug '26

15 Aug '26

Attention is currently required from: pespin. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-msc/+/43253?usp=email to look at the new patch set (#2). Change subject: smpp: Fix potential write buffer overflow on sms->user_data ...................................................................... smpp: Fix potential write buffer overflow on sms->user_data The writes to sms->user_data in submit_to_sms() were not being validated against the maximum size of the buffer, which could lead into writing past the buffer limits. In order to assure safe encdoing of septets into the buffer, the new libosmocore gsm_septet_pack2() is required. Related: OS#7059 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Depends: libosmocore.git Change-Id I4baa19007c65275ead3d1fc92462bfb8ab68e036 Change-Id: Iee701a3b033d78244fc10dd8563a094b8de385c0 --- M TODO-RELEASE M src/libsmpputil/smpp_msc.c 2 files changed, 25 insertions(+), 5 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/53/43253/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43253?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: Iee701a3b033d78244fc10dd8563a094b8de385c0 Gerrit-Change-Number: 43253 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm: Reject BSSMAP Encryption Information IE with key length != 8
by pespin 15 Aug '26

15 Aug '26

pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email ) Change subject: gsm: Reject BSSMAP Encryption Information IE with key length != 8 ...................................................................... Patch Set 3: (1 comment) Patchset: PS3: > Hmm, this supersedes my https://gerrit.osmocom.org/c/libosmocore/+/43244 submitted earlier today. I'm sorry, I was actually unaware of that patch, I must have marked as read on my email client somehow without noticing, there's so many patches these last days. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9fd70875f35cebb923278869e1260c5bf3047439 Gerrit-Change-Number: 43251 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 15:49:56 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm: Reject BSSMAP Encryption Information IE with key length != 8
by fixeria 15 Aug '26

15 Aug '26

fixeria has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email ) Change subject: gsm: Reject BSSMAP Encryption Information IE with key length != 8 ...................................................................... Patch Set 3: (1 comment) Patchset: PS3: Hmm, this supersedes my https://gerrit.osmocom.org/c/libosmocore/+/43244 submitted earlier today. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9fd70875f35cebb923278869e1260c5bf3047439 Gerrit-Change-Number: 43251 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 15:48:02 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[S] Change in libosmocore[master]: gsm: Introduce gsm_septet_pack2() and deprecate gsm_septet_pack()
by pespin 15 Aug '26

15 Aug '26

pespin has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/libosmocore/+/43252?usp=email ) Change subject: gsm: Introduce gsm_septet_pack2() and deprecate gsm_septet_pack() ...................................................................... gsm: Introduce gsm_septet_pack2() and deprecate gsm_septet_pack() The new gsm_septet_pack2() comes with a new parameter containing the size of the output buffer, effectively protecting against write buffer overflows. Related: OS#7059 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: I4baa19007c65275ead3d1fc92462bfb8ab68e036 --- M TODO-RELEASE M include/osmocom/gsm/gsm_utils.h M src/gsm/gsm_utils.c M src/gsm/libosmogsm.map M tests/sms/sms_test.c 5 files changed, 29 insertions(+), 8 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/52/43252/3 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43252?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I4baa19007c65275ead3d1fc92462bfb8ab68e036 Gerrit-Change-Number: 43252 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-CC: Jenkins Builder

1 0

[S] Change in osmo-msc[master]: smpp: Fix potential write buffer overflow on sms->user_data
by pespin 15 Aug '26

15 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-msc/+/43253?usp=email ) Change subject: smpp: Fix potential write buffer overflow on sms->user_data ...................................................................... smpp: Fix potential write buffer overflow on sms->user_data The writes to sms->user_data in submit_to_sms() were not being validated against the maximum size of the buffer, which could lead into writing past the buffer limits. In order to assure safe encdoing of septets into the buffer, the new libosmocore gsm_septet_pack2() is required. Related: OS#7059 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: Iee701a3b033d78244fc10dd8563a094b8de385c0 --- M TODO-RELEASE M src/libsmpputil/smpp_msc.c 2 files changed, 25 insertions(+), 5 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/53/43253/1 diff --git a/TODO-RELEASE b/TODO-RELEASE index c8858d8..84a2985 100644 --- a/TODO-RELEASE +++ b/TODO-RELEASE @@ -9,3 +9,4 @@ #library what description / commit summary line libosmovty >=1.12.1 working optional-multi-choice libosmocore >1.12.0 log_get_context(), log_{get,set}_filter(_data)() +libosmogsm >1.14.1 gsm_septet_pack2() diff --git a/src/libsmpputil/smpp_msc.c b/src/libsmpputil/smpp_msc.c index d68dcc0..5fdba36 100644 --- a/src/libsmpputil/smpp_msc.c +++ b/src/libsmpputil/smpp_msc.c @@ -132,6 +132,7 @@ struct tlv_t *t; int mode; int can_store_sms = ((submit->esm_class & SMPP34_MSG_MODE_MASK) != 2); /* != forward mode */ + int rc; dest = subscr_by_dst(net, submit->dest_addr_npi, submit->dest_addr_ton, @@ -247,21 +248,39 @@ ud_len = *sms_msg + 1; if (ud_len > sms_msg_len) { sms_free(sms); - LOGP(DLSMS, LOGL_ERROR, "invalid ud_len=%u > sms_msg_len=%u\n", ud_len, - sms_msg_len); + LOGP(DLSMS, LOGL_ERROR, "invalid ud_len=%u > sms_msg_len=%u\n", + ud_len, sms_msg_len); + return ESME_RINVPARLEN; + } + if (ud_len > sizeof(sms->user_data)) { + sms_free(sms); + LOGP(DLSMS, LOGL_ERROR, "invalid sms_msg_len=%u > %zu\n", + sms_msg_len, sizeof(sms->user_data)); return ESME_RINVPARLEN; } printf("copying %u bytes user data...\n", ud_len); - memcpy(sms->user_data, sms_msg, - OSMO_MIN(ud_len, sizeof(sms->user_data))); + memcpy(sms->user_data, sms_msg, ud_len); sms_msg += ud_len; sms_msg_len -= ud_len; padbits = 7 - (ud_len % 7); } - gsm_septet_pack(sms->user_data+ud_len, sms_msg, sms_msg_len, padbits); + rc = gsm_septet_pack2(sms->user_data + ud_len, sizeof(sms->user_data) - ud_len, + sms_msg, sms_msg_len, padbits); + if (rc < 0) { + sms_free(sms); + LOGP(DLSMS, LOGL_ERROR, "invalid ud_len=%u + sms_msg_len=%u > %zu\n", + ud_len, sms_msg_len, sizeof(sms->user_data)); + return ESME_RINVPARLEN; + } sms->user_data_len = (ud_len*8 + padbits)/7 + sms_msg_len;/* SEPTETS */ /* FIXME: sms->text */ } else { + if (sms_msg_len > sizeof(sms->user_data)) { + sms_free(sms); + LOGP(DLSMS, LOGL_ERROR, "invalid sms_msg_len=%u > %zu\n", + sms_msg_len, sizeof(sms->user_data)); + return ESME_RINVPARLEN; + } memcpy(sms->user_data, sms_msg, sms_msg_len); sms->user_data_len = sms_msg_len; } -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43253?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: Iee701a3b033d78244fc10dd8563a094b8de385c0 Gerrit-Change-Number: 43253 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026