August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by laforge 14 Aug '26

14 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... sgs_iface: guard against over-long MME name IEs. The function decode_mme_name decodes the MME name from the given tlv_parsed struct a buffer referenced by mme_name. Since the maximum length of the MME name is fixed, the length of the output buffer is also fixed (SGS_MME_NAME_LEN bytes + 1 byte string terminator). Unfortunately the function does not guard against over-long input. When the SGSAP_IE_MME_NAME IE is longer than SGS_MME_NAME_LEN, then either memcpy or osmo_apn_to_str may overflow the output buffer. Bug reported by: adam.bedard(a)gmail.com Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Related: OS#7058 --- M src/libmsc/sgs_iface.c 1 file changed, 7 insertions(+), 2 deletions(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve diff --git a/src/libmsc/sgs_iface.c b/src/libmsc/sgs_iface.c index 178aa64..4425a93 100644 --- a/src/libmsc/sgs_iface.c +++ b/src/libmsc/sgs_iface.c @@ -160,7 +160,7 @@ } /* Decode and verify MME name */ -static int decode_mme_name(char *mme_name, const struct tlv_parsed *tp) +static int decode_mme_name(char *mme_name, size_t mme_name_len, const struct tlv_parsed *tp) { const uint8_t *mme_name_enc = TLVP_VAL_MINLEN(tp, SGSAP_IE_MME_NAME, SGS_MME_NAME_LEN); struct osmo_gummei gummei; @@ -168,6 +168,11 @@ if (!mme_name_enc) return -EINVAL; + /* do not accept over-long SGSAP_IE_MME_NAME IEs which would exceed the length + * of the output buffer. */ + if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) >= mme_name_len) + return -EINVAL; + /* some implementations use FDQN format violating TS 29.118 9.3.14 */ if (!osmo_parse_mme_domain(&gummei, (const char *) mme_name_enc)) { memcpy(mme_name, mme_name_enc, TLVP_LEN(tp, SGSAP_IE_MME_NAME)); @@ -1040,7 +1045,7 @@ } if (TLVP_PRESENT(&tp, SGSAP_IE_MME_NAME)) { - if (decode_mme_name(mme_name, &tp) != 0) { + if (decode_mme_name(mme_name, sizeof(mme_name), &tp) != 0) { TX_STATUS_AND_LOG(sgc, msg_type, SGSAP_SGS_CAUSE_INVALID_MAND_IE, "SGsAP Message %s with invalid MME-Name, dropping\n"); goto error; -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: dexter, pespin. laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... Patch Set 4: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 08:51:28 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-msc[master]: sgs_iface: clean up code in function decode_mme_name
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: dexter, pespin. laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email ) Change subject: sgs_iface: clean up code in function decode_mme_name ...................................................................... Patch Set 4: (1 comment) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/e192a2db_b2a81dff?usp… : PS2, Line 178: > I have a problem with alternate path: At the beginning of this function we require the contents of S […] the questions is what such proprietary formats are, how they look like, used by whom, and why there was any attempt to support them at all. This code was merged as part of ``` commit e2bd9eb37d8160b436a5a1bffc14690321f40ae6 Author: Omar Ramadan <omar.ramadan93(a)gmail.com> Date: Fri Apr 12 09:03:39 2019 -0700 ``` So someone had a need at some point. I would be fine with not enforcing a minimum length of 55 digits at all, and possibly printing just a warning about it (if at all). To the MSC, AFAICT it doesn't really matter. We just treat the MME name as an opaque identifier and don't ever try to parse it, right? -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 Gerrit-Change-Number: 43237 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 08:51:12 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm0808: fix buffer overflow in gsm0808_dec_encrypt_info()
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43244?usp=email ) Change subject: gsm0808: fix buffer overflow in gsm0808_dec_encrypt_info() ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43244?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I3140319c6ab5dabb2e356f5c59f6cb05542554cd Gerrit-Change-Number: 43244 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 08:45:54 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmocore[master]: gsm/ipa: fix out-of-bounds read in TLV tag logging
by laforge 14 Aug '26

14 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email ) Change subject: gsm/ipa: fix out-of-bounds read in TLV tag logging ...................................................................... gsm/ipa: fix out-of-bounds read in TLV tag logging ipa_ccm_idtag_parse_off(), ipa_ccm_id_get_parse() and ipa_ccm_id_resp_parse() logged the TLV payload with an unbounded '%s' conversion over a buffer that is not guaranteed to be NUL-terminated, so strlen() could run past the end of the caller's receive buffer. Bound the conversion to the decoded value length using '%.*s'. Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 3 insertions(+), 3 deletions(-) Approvals: laforge: Looks good to me, approved pespin: Looks good to me, but someone else must approve Jenkins Builder: Verified diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index 963f97d..d554faf 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -139,7 +139,7 @@ return -EINVAL; } - LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - len_offset, cur); dec->lv[t_tag].len = t_len - len_offset; dec->lv[t_tag].val = cur; @@ -180,7 +180,7 @@ return -EINVAL; } - LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur); dec->lv[t_tag].len = t_len-1; dec->lv[t_tag].val = cur; @@ -222,7 +222,7 @@ return -EINVAL; } - DEBUGPC(DLMI, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + DEBUGPC(DLMI, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur); dec->lv[t_tag].len = t_len-1; dec->lv[t_tag].val = cur; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Gerrit-Change-Number: 43230 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers
by laforge 14 Aug '26

14 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email ) Change subject: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers ...................................................................... gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers ipa_ccm_id_get_parse() and ipa_ccm_id_resp_parse() only checked t_len against the remaining buffer length, so a zero-length tag (t_len == 0) passed the check. The subsequent "t_len - 1" then underflowed: dec->lv[t_tag].len (a uint16_t) became 65535, and cur/len were adjusted in the wrong direction, letting the loop walk past the buffer on the next iteration. Reject t_len < 1 up front, mirroring the equivalent guard already present in ipa_ccm_idtag_parse_off(). Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 12 insertions(+), 0 deletions(-) Approvals: laforge: Looks good to me, approved pespin: Looks good to me, but someone else must approve Jenkins Builder: Verified diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index d554faf..50fa31f 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -174,6 +174,12 @@ t_len = *cur++; t_tag = *cur++; + if (t_len < 1) { + LOGPC(DLMI, LOGL_DEBUG, "\n"); + LOGP(DLMI, LOGL_ERROR, "The tag length is too short: %d < 1\n", t_len); + return -EINVAL; + } + if (t_len > len + 1) { LOGPC(DLMI, LOGL_DEBUG, "\n"); LOGP(DLMI, LOGL_ERROR, "The tag does not fit: %d > %d\n", t_len, len + 1); @@ -216,6 +222,12 @@ cur += 2; t_tag = *cur++; + if (t_len < 1) { + LOGPC(DLMI, LOGL_DEBUG, "\n"); + LOGP(DLMI, LOGL_ERROR, "The tag length is too short: %d < 1\n", t_len); + return -EINVAL; + } + if (t_len > len + 1) { LOGPC(DLMI, LOGL_DEBUG, "\n"); LOGP(DLMI, LOGL_ERROR, "The tag does not fit: %d > %d\n", t_len, len + 1); -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3 Gerrit-Change-Number: 43231 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email ) Change subject: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3 Gerrit-Change-Number: 43231 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 08:45:06 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmocore[master]: gsm/ipa: fix out-of-bounds read in TLV tag logging
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email ) Change subject: gsm/ipa: fix out-of-bounds read in TLV tag logging ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Gerrit-Change-Number: 43230 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 08:45:02 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmocore[master]: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
by laforge 14 Aug '26

14 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email ) ( 3 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder ...................................................................... gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder cbsp_dec_write_repl() then takes the 8-bit page count straight off the wire and uses it as the bound over an array of 16 entries, overflowing the array on the heap. Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737 Closes: OS#7053 --- M src/gsm/cbsp.c 1 file changed, 5 insertions(+), 2 deletions(-) Approvals: fixeria: Looks good to me, but someone else must approve pespin: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c index a5e58f4..bc8bc4f 100644 --- a/src/gsm/cbsp.c +++ b/src/gsm/cbsp.c @@ -633,6 +633,7 @@ /*********************************************************************** * Message Decoding ***********************************************************************/ +#define MAX_NUM_CBS_PAGES 16 /* max. number of pages in a given CBS message */ /* 8.1.3.1 WRITE REPLACE */ static int cbsp_dec_write_repl(struct osmo_cbsp_write_replace *out, const struct tlv_parsed *tp, @@ -684,8 +685,10 @@ out->u.cbs.num_bcast_req = tlvp_val16be(tp, CBSP_IEI_NUM_BCAST_REQ); out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS); num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES); - if (num_of_pages < 1) + if (num_of_pages < 1 || num_of_pages > MAX_NUM_CBS_PAGES) { + osmo_cbsp_errstr = "invalid number of pages"; return -EINVAL; + } /* parse pages */ for (i = 0; i < num_of_pages; i++) { const uint8_t *ie = TLVP_VAL(&tp[i], CBSP_IEI_MSG_CONTENT); @@ -1264,7 +1267,7 @@ OSMO_ASSERT(in->l1h != NULL && in->l2h != NULL); struct osmo_cbsp_decoded *out = talloc_zero(ctx, struct osmo_cbsp_decoded); const struct cbsp_header *h = msgb_l1(in); - struct tlv_parsed tp[16]; /* max. number of pages in a given CBS message */ + struct tlv_parsed tp[MAX_NUM_CBS_PAGES]; unsigned int len; int rc; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737 Gerrit-Change-Number: 43215 Gerrit-PatchSet: 5 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-msc[master]: sgs_iface: clean up code in function decode_mme_name
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. Hello Jenkins Builder, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email to look at the new patch set (#4). Change subject: sgs_iface: clean up code in function decode_mme_name ...................................................................... sgs_iface: clean up code in function decode_mme_name The function decode_mme_name is a bit hard to read and also has some minor problems we can optimize. - Do not call TLVP_LEN each time we need the length of the TLV IE. Call it once and keep the value in a variable. - mme_name_enc holds the value part of the TLV IE, we can use this variable instead of calling TLVP_VAL all all the time. - When we have copied the value part of the TLV IE using memset, let's ensure that the string is terminated. - Add/fix spec references. Related: OS#7058 Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 --- M src/libmsc/sgs_iface.c 1 file changed, 9 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/37/43237/4 -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 Gerrit-Change-Number: 43237 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026