August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... Patch Set 2: (1 comment) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/7dc3578f_198536da?usp… : PS2, Line 165: const uint8_t *mme_name_enc = TLVP_VAL_MINLEN(tp, SGSAP_IE_MME_NAME, SGS_MME_NAME_LEN); > In recent versions 3GPP TS 29.118, section 9.4.13 only says that it is an FQDN with no further info. […] Done -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 17:26:43 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: pespin <pespin(a)sysmocom.de> Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... Patch Set 2: (5 comments) Patchset: PS2: @pespin: The things you have pointed out are not relevant for the security problem this patch addresses, so I have addressed those points in a follow up-patch after this one. (Except the open question with the length, but lets discuss this one also in a follow up patch then.) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/cef9f704_4eaf20bf?usp… : PS2, Line 165: const uint8_t *mme_name_enc = TLVP_VAL_MINLEN(tp, SGSAP_IE_MME_NAME, SGS_MME_NAME_LEN); > so is the TLV value actually expected to be at least SGS_MME_NAME_LEN? Is that correct? In recent versions 3GPP TS 29.118, section 9.4.13 only says that it is an FQDN with no further info. So the length could be the maximum length of an FQDN. However in the V13.5.0 version of that spec they explicitly state that the FQDN has an exact length of 55 bytes. Then the line would be correct, but some doubt on my side remains. https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/9056c000_6100e837?usp… : PS2, Line 173: if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > mme_name_len - 1) > "if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) >= mme_name_len)" looks a lot easier to read to me but fine :) I like the "- 1" notation more since it tells me that the comparison is related to the handling of the \0 char. https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/4fb6ba3d_5428ed32?usp… : PS2, Line 179: return 0; > I'd store TLVP_LEN(tp, SGSAP_IE_MME_NAME) in some len and add an extra mme_name[len] = '\0' here so […] Done https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/b43ddcfe_9dc95932?usp… : PS2, Line 183: osmo_apn_to_str(mme_name, TLVP_VAL(tp, SGSAP_IE_MME_NAME), TLVP_LEN(tp, SGSAP_IE_MME_NAME)); > isn't "TLVP_VAL(tp, SGSAP_IE_MME_NAME)" here just "mme_name_enc" ? I think you are right. -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 17:24:16 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: dexter, laforge. pespin has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... Patch Set 2: (1 comment) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/721e65be_479e756b?usp… : PS2, Line 173: if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > mme_name_len - 1) > "if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) >= mme_name_len)" looks a lot easier to read to me but fine :) This has the extra problem that with mme_name_len you end up with a negative value on a size_t. Please use >= instead. -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 17:13:03 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-msc[master]: sgs_iface: clean up code in function decode_mme_name
by dexter 14 Aug '26

14 Aug '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email ) Change subject: sgs_iface: clean up code in function decode_mme_name ...................................................................... sgs_iface: clean up code in function decode_mme_name The function decode_mme_name is a bit hard to read and also has some minor problems we can optimize. - do not call TLVP_LEN each time we need the length of the TLV IE. Call it once and keep the value in a variable - mme_name_enc holds the value part of the TLV IE, we can use this variable instead of calling TLVP_VAL all all the time. - When we have copied the value part of the TLV IE using memset, let's ensure that the string is terminated. Related: OS#7058 Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 --- M src/libmsc/sgs_iface.c 1 file changed, 5 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/37/43237/1 diff --git a/src/libmsc/sgs_iface.c b/src/libmsc/sgs_iface.c index dd39816..aa0ccad 100644 --- a/src/libmsc/sgs_iface.c +++ b/src/libmsc/sgs_iface.c @@ -163,6 +163,7 @@ static int decode_mme_name(char *mme_name, size_t mme_name_len, const struct tlv_parsed *tp) { const uint8_t *mme_name_enc = TLVP_VAL_MINLEN(tp, SGSAP_IE_MME_NAME, SGS_MME_NAME_LEN); + size_t mme_name_enc_len = TLVP_LEN(tp, SGSAP_IE_MME_NAME); struct osmo_gummei gummei; if (!mme_name_enc) @@ -170,17 +171,18 @@ /* do not accept over-long SGSAP_IE_MME_NAME IEs which would exceed the length * of the output buffer. */ - if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > mme_name_len - 1) + if (mme_name_enc_len > mme_name_len - 1) return -EINVAL; /* some implementations use FDQN format violating TS 29.118 9.3.14 */ if (!osmo_parse_mme_domain(&gummei, (const char *) mme_name_enc)) { - memcpy(mme_name, mme_name_enc, TLVP_LEN(tp, SGSAP_IE_MME_NAME)); + memcpy(mme_name, mme_name_enc, mme_name_enc_len); + mme_name[mme_name_enc_len] = '\0'; return 0; } /* decode the MME name from DNS labels to string */ - osmo_apn_to_str(mme_name, TLVP_VAL(tp, SGSAP_IE_MME_NAME), TLVP_LEN(tp, SGSAP_IE_MME_NAME)); + osmo_apn_to_str(mme_name, mme_name_enc, mme_name_enc_len); /* try to parse the MME name into a GUMMEI as a test for the format */ if (osmo_parse_mme_domain(&gummei, mme_name) < 0) -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 Gerrit-Change-Number: 43237 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in libosmocore[master]: bits: Fix osmo_pbit2ubit() reading extra input byte on num_bits%8==0
by pespin 14 Aug '26

14 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43236?usp=email ) Change subject: bits: Fix osmo_pbit2ubit() reading extra input byte on num_bits%8==0 ...................................................................... bits: Fix osmo_pbit2ubit() reading extra input byte on num_bits%8==0 For instance, if num_bits was 0, it would read in[0], which is unexpected. Related: OS#7052 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: I3ec32631440f3df48627eac3ec4cefae32ef7244 --- M src/core/bits.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/36/43236/1 diff --git a/src/core/bits.c b/src/core/bits.c index a4c0970..fc41d4a 100644 --- a/src/core/bits.c +++ b/src/core/bits.c @@ -148,7 +148,7 @@ ubit_t *cur = out; ubit_t *limit = out + num_bits; - for (i = 0; i < (num_bits/8)+1; i++) { + for (i = 0; i < ((num_bits + 7) / 8); i++) { pbit_t byte = in[i]; *cur++ = (byte >> 7) & 1; if (cur >= limit) -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43236?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I3ec32631440f3df48627eac3ec4cefae32ef7244 Gerrit-Change-Number: 43236 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: dexter, laforge. pespin has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... Patch Set 2: (4 comments) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/50b589bf_e14cafa9?usp… : PS2, Line 165: const uint8_t *mme_name_enc = TLVP_VAL_MINLEN(tp, SGSAP_IE_MME_NAME, SGS_MME_NAME_LEN); so is the TLV value actually expected to be at least SGS_MME_NAME_LEN? Is that correct? https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/91fad0c1_c34dfbda?usp… : PS2, Line 173: if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > mme_name_len - 1) "if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) >= mme_name_len)" looks a lot easier to read to me but fine :) https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/732193ee_373b2e24?usp… : PS2, Line 179: return 0; I'd store TLVP_LEN(tp, SGSAP_IE_MME_NAME) in some len and add an extra mme_name[len] = '\0' here so that we make sure it ends up NULL terminated in this function. https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/bfd8e1c3_1f7f1df5?usp… : PS2, Line 183: osmo_apn_to_str(mme_name, TLVP_VAL(tp, SGSAP_IE_MME_NAME), TLVP_LEN(tp, SGSAP_IE_MME_NAME)); isn't "TLVP_VAL(tp, SGSAP_IE_MME_NAME)" here just "mme_name_enc" ? -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 16:41:29 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[S] Change in libosmocore[master]: gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}()
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43235?usp=email ) Change subject: gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}() ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43235?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I59fe4df8045dbe1e2b9509330527408b84abf2e4 Gerrit-Change-Number: 43235 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 16:35:06 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmocore[master]: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email ) Change subject: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse() ...................................................................... Patch Set 1: Code-Review+1 (1 comment) File src/gsm/ipa.c: https://gerrit.osmocom.org/c/libosmocore/+/43232/comment/89b46e81_21804100?… : PS1, Line 212: uint16_t t_len; Waoh so ipa_ccm_id_resp_parse() has a 2 byte len and ipa_ccm_id_get_parse() has a 1 byte len? -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99 Gerrit-Change-Number: 43232 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 16:31:29 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmocore[master]: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email ) Change subject: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3 Gerrit-Change-Number: 43231 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 16:28:42 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmocore[master]: gsm/ipa: fix out-of-bounds read in TLV tag logging
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email ) Change subject: gsm/ipa: fix out-of-bounds read in TLV tag logging ...................................................................... Patch Set 1: Code-Review+1 (1 comment) Patchset: PS1: Assuming the https://en.wikipedia.org/wiki/Printf#Precision_field is standard C, then +1. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Gerrit-Change-Number: 43230 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 16:26:55 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026