August 2026 - gerrit-log - lists.osmocom.org

[S] Change in libosmocore[master]: gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}()
by fixeria 14 Aug '26

14 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43235?usp=email ) Change subject: gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}() ...................................................................... gsm0480: fix out-of-bounds reads in parse_ss_{invoke,return_result}() Both Facility component parsers checked 'offset' against 'length' one (or two) bytes short of the index they went on to dereference, and parse_ss_invoke() never re-validated 'offset' after skipping the optional Linked ID, whose skip length is attacker-controlled. The same off-by-one on the operation-code path also let "length - offset - 3" underflow a uint16_t, handing parse_process_uss_req() a bogus, oversized length that bypassed its own bounds check and grew the over-read into a memcpy() into req->ussd_data/req->ussd_text. Tighten each guard to cover the index actually dereferenced, and re-check 'offset' against 'length' after the Linked ID skip and after the post-SEQUENCE-tag increment in parse_ss_return_result(). Change-Id: I59fe4df8045dbe1e2b9509330527408b84abf2e4 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Fixes: OS#7051 --- M src/gsm/gsm0480.c 1 file changed, 15 insertions(+), 6 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/35/43235/1 diff --git a/src/gsm/gsm0480.c b/src/gsm/gsm0480.c index a8eac6b..5db5bed 100644 --- a/src/gsm/gsm0480.c +++ b/src/gsm/gsm0480.c @@ -548,17 +548,24 @@ offset = invoke_data[1] + 2; req->invoke_id = invoke_data[2]; - /* look ahead once */ - if (offset + 1 > length) + /* look ahead once: need invoke_data[offset] and, if it turns out to be + * the optional Linked ID tag, invoke_data[offset+1] as well */ + if (offset + 2 > length) return 0; /* optional part */ - if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) + if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) { offset += invoke_data[offset+1] + 2; /* skip over it */ + /* offset moved by an attacker-controlled amount: re-validate */ + if (offset >= length) + return 0; + } + /* mandatory part */ if (invoke_data[offset] == GSM0480_OPERATION_CODE) { - if (offset + 2 > length) + /* need invoke_data[offset+2] below, and length - offset - 3 must not underflow */ + if (offset + 3 > length) return 0; uint8_t operation_code = invoke_data[offset+2]; req->opcode = operation_code; @@ -624,10 +631,12 @@ if (rr_data[offset] != GSM_0480_SEQUENCE_TAG) return 0; - if (offset + 2 > length) + offset += 2; + + /* need rr_data[offset+2] below, and length - offset - 3 must not underflow */ + if (offset + 3 > length) return 0; - offset += 2; operation_code = rr_data[offset + 2]; req->opcode = operation_code; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43235?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I59fe4df8045dbe1e2b9509330527408b84abf2e4 Gerrit-Change-Number: 43235 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... Patch Set 2: (1 comment) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/744cfe16_463deaa8?usp… : PS1, Line 172: if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > SGS_MME_NAME_LEN) > Please instead pass mme_name buffer size as a parameter to the function. Done -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 16:12:07 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. Hello Jenkins Builder, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review-1 by pespin, Verified+1 by Jenkins Builder Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... sgs_iface: guard against over-long MME name IEs. The function decode_mme_name decodes the MME name from the given tlv_parsed struct a buffer referenced by mme_name. Since the maximum length of the MME name is fixed, the length of the output buffer is also fixed (SGS_MME_NAME_LEN bytes + 1 byte string terminator). Unfortunately the function does not guard against over-long input. When the SGSAP_IE_MME_NAME IE is longer than SGS_MME_NAME_LEN, then either memcpy or osmo_apn_to_str may overflow the output buffer. Bug reported by: adam.bedard(a)gmail.com Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Related: OS#7058 --- M src/libmsc/sgs_iface.c 1 file changed, 7 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/29/43229/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: iuup: Improve validation of header size
by pespin 14 Aug '26

14 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43233?usp=email ) Change subject: iuup: Improve validation of header size ...................................................................... iuup: Improve validation of header size * Validate minimum header length of all IuUP packet types. * Use the existing packed structs to get the expected size of the header * Move IUUP_PDU_T_DATA_NOCRC case below the IUUP_PDU_T_DATA_CRC case, to match spec and numbering order (0,1,14). * The IUUP_PDU_T_DATA_NOCRC length check was wrong, it should have been <3, this is now fixed when checking agains the packed struct. Change-Id: I6976003a8b9761ade978c430613341b9eeb52d9c --- M include/osmocom/gsm/protocol/gsm_25_415.h M src/gsm/iuup.c 2 files changed, 13 insertions(+), 9 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/33/43233/1 diff --git a/include/osmocom/gsm/protocol/gsm_25_415.h b/include/osmocom/gsm/protocol/gsm_25_415.h index 5c4dd2b..f45b87a 100644 --- a/include/osmocom/gsm/protocol/gsm_25_415.h +++ b/include/osmocom/gsm/protocol/gsm_25_415.h @@ -158,9 +158,9 @@ /* 3GPP TS 25.415 Section 6.6.2 + 6.6.3.1 */ enum iuup_pdu_type { - IUUP_PDU_T_DATA_CRC = 0, - IUUP_PDU_T_DATA_NOCRC = 1, - IUUP_PDU_T_CONTROL = 14, + IUUP_PDU_T_DATA_CRC = 0, /* PDU Type 0 */ + IUUP_PDU_T_DATA_NOCRC = 1, /* PDU Type 1 */ + IUUP_PDU_T_CONTROL = 14, /* PDU Type 14 */ }; /* 3GPP TS 25.415 Section 6.6.3.2 */ diff --git a/src/gsm/iuup.c b/src/gsm/iuup.c index df303e5..0952c5e 100644 --- a/src/gsm/iuup.c +++ b/src/gsm/iuup.c @@ -871,7 +871,7 @@ struct iuup_pdutype0_hdr *t0h; struct iuup_pdutype14_hdr *t14h; - if (len < 3) + if (len < 3) /* common minimum length for all IuUP packet types */ return -EINVAL; header_crc_computed = osmo_iuup_compute_header_crc(data, len); @@ -881,18 +881,22 @@ return -EIO; } switch (pdu_type) { - case IUUP_PDU_T_DATA_NOCRC: - if (len < 4) + case IUUP_PDU_T_DATA_CRC: /* PDU Type 0 */ + if (len < sizeof(struct iuup_pdutype0_hdr)) return -EINVAL; - break; - case IUUP_PDU_T_DATA_CRC: t0h = (struct iuup_pdutype0_hdr *) data; payload_crc = ((uint16_t)t0h->payload_crc_hi << 8) | t0h->payload_crc_lo; payload_crc_computed = osmo_iuup_compute_payload_crc(data, len); if (payload_crc != payload_crc_computed) goto payload_crc_err; break; - case IUUP_PDU_T_CONTROL: + case IUUP_PDU_T_DATA_NOCRC: /* PDU Type 1 */ + if (len < sizeof(struct iuup_pdutype1_hdr)) + return -EINVAL; + break; + case IUUP_PDU_T_CONTROL: /* PDU Type 14 */ + if (len < sizeof(struct iuup_pdutype14_hdr)) + return -EINVAL; t14h = (struct iuup_pdutype14_hdr *) data; if (t14h->ack_nack == IUUP_AN_PROCEDURE) { payload_crc = ((uint16_t)t14h->payload_crc_hi << 8) | t14h->payload_crc_lo; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43233?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I6976003a8b9761ade978c430613341b9eeb52d9c Gerrit-Change-Number: 43233 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: iuup: Avoid stack buffer-overflow rx IuUP with payload >1024 bytes
by pespin 14 Aug '26

14 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43234?usp=email ) Change subject: iuup: Avoid stack buffer-overflow rx IuUP with payload >1024 bytes ...................................................................... iuup: Avoid stack buffer-overflow rx IuUP with payload >1024 bytes While verifying the IuUP payload CRC, osmo_pbit2ubit() is called where an out buffer of fixed size is passed and written to. Since there was no check validating the received IuUP payload would fit in that buffer, it could happen that osmo_pbit2ubit() would write past the stack buffer. * Make sure the PDU payload size is validated to be smaller than the buf * Increase a the buf size to 1500 to make sure all UDP/RTP/IuUP payloads on regular ethernet frames can fit just well. Related: OS#7052 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: Id71d3963649f8f711b1584daec3508951ebf462d --- M src/core/bits.c M src/gsm/iuup.c 2 files changed, 16 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/34/43234/1 diff --git a/src/core/bits.c b/src/core/bits.c index 8616d32..a4c0970 100644 --- a/src/core/bits.c +++ b/src/core/bits.c @@ -139,6 +139,8 @@ * \param[in] in input buffer of packed bits * \param[in] num_bits number of bits * \return number of bytes used in \ref out + * + * Note: size of out array is expected to be ">= num_bits" bytes. */ int osmo_pbit2ubit(ubit_t *out, const pbit_t *in, unsigned int num_bits) { diff --git a/src/gsm/iuup.c b/src/gsm/iuup.c index 0952c5e..622302a 100644 --- a/src/gsm/iuup.c +++ b/src/gsm/iuup.c @@ -70,9 +70,12 @@ int osmo_iuup_compute_payload_crc(const uint8_t *iuup_pdu, unsigned int pdu_len) { - ubit_t buf[1024*8]; + /* Assume no IuUP payloads bigger than a regular ethernet frame: */ + const unsigned int max_supported_iuup_payload_len_bytes = 1500; + ubit_t buf[max_supported_iuup_payload_len_bytes * 8]; uint8_t pdu_type; - int offset, payload_len_bytes; + int offset; + unsigned int payload_len_bytes; if (pdu_len < 1) return -1; @@ -91,6 +94,11 @@ return -1; payload_len_bytes = pdu_len - offset; + + /* Guard against osmo_pbit2ubit writing past buf: */ + if (payload_len_bytes > max_supported_iuup_payload_len_bytes) + return -1; + osmo_pbit2ubit(buf, iuup_pdu+offset, payload_len_bytes*8); return osmo_crc16gen_compute_bits(&iuup_data_crc_code, buf, payload_len_bytes*8); } @@ -887,6 +895,8 @@ t0h = (struct iuup_pdutype0_hdr *) data; payload_crc = ((uint16_t)t0h->payload_crc_hi << 8) | t0h->payload_crc_lo; payload_crc_computed = osmo_iuup_compute_payload_crc(data, len); + if (payload_crc_computed < 0) + goto payload_crc_err; if (payload_crc != payload_crc_computed) goto payload_crc_err; break; @@ -901,6 +911,8 @@ if (t14h->ack_nack == IUUP_AN_PROCEDURE) { payload_crc = ((uint16_t)t14h->payload_crc_hi << 8) | t14h->payload_crc_lo; payload_crc_computed = osmo_iuup_compute_payload_crc(data, len); + if (payload_crc_computed < 0) + goto payload_crc_err; if (payload_crc != payload_crc_computed) goto payload_crc_err; } -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43234?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Id71d3963649f8f711b1584daec3508951ebf462d Gerrit-Change-Number: 43234 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmocore[master]: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse()
by fixeria 14 Aug '26

14 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email ) Change subject: gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse() ...................................................................... gsm/ipa: fix t_len truncation in ipa_ccm_id_resp_parse() The IPA CCM ID RESP TLV format uses a 16bit length field, and osmo_load16be() is used to read it, but t_len was declared as uint8_t, silently truncating any length above 255. Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99 Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/32/43232/1 diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index 50fa31f..3e631de 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -209,7 +209,7 @@ * \returns 0 on success; negative on error */ int ipa_ccm_id_resp_parse(struct tlv_parsed *dec, const uint8_t *buf, unsigned int len) { - uint8_t t_len; + uint16_t t_len; uint8_t t_tag; const uint8_t *cur = buf; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43232?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I86392c51235faa2d985ac82b04a9681ae176ad99 Gerrit-Change-Number: 43232 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in libosmocore[master]: gsm/ipa: fix out-of-bounds read in TLV tag logging
by fixeria 14 Aug '26

14 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email ) Change subject: gsm/ipa: fix out-of-bounds read in TLV tag logging ...................................................................... gsm/ipa: fix out-of-bounds read in TLV tag logging ipa_ccm_idtag_parse_off(), ipa_ccm_id_get_parse() and ipa_ccm_id_resp_parse() logged the TLV payload with an unbounded '%s' conversion over a buffer that is not guaranteed to be NUL-terminated, so strlen() could run past the end of the caller's receive buffer. Bound the conversion to the decoded value length using '%.*s'. Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 3 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/30/43230/1 diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index 963f97d..d554faf 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -139,7 +139,7 @@ return -EINVAL; } - LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - len_offset, cur); dec->lv[t_tag].len = t_len - len_offset; dec->lv[t_tag].val = cur; @@ -180,7 +180,7 @@ return -EINVAL; } - LOGPC(DLMI, LOGL_DEBUG, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + LOGPC(DLMI, LOGL_DEBUG, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur); dec->lv[t_tag].len = t_len-1; dec->lv[t_tag].val = cur; @@ -222,7 +222,7 @@ return -EINVAL; } - DEBUGPC(DLMI, "%s='%s' ", ipa_ccm_idtag_name(t_tag), cur); + DEBUGPC(DLMI, "%s='%.*s' ", ipa_ccm_idtag_name(t_tag), t_len - 1, cur); dec->lv[t_tag].len = t_len-1; dec->lv[t_tag].val = cur; -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43230?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9db494563c326a2b28e464e66c24cbe34409b90d Gerrit-Change-Number: 43230 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers
by fixeria 14 Aug '26

14 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email ) Change subject: gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers ...................................................................... gsm/ipa: reject t_len == 0 in ID_GET/ID_RESP TLV parsers ipa_ccm_id_get_parse() and ipa_ccm_id_resp_parse() only checked t_len against the remaining buffer length, so a zero-length tag (t_len == 0) passed the check. The subsequent "t_len - 1" then underflowed: dec->lv[t_tag].len (a uint16_t) became 65535, and cur/len were adjusted in the wrong direction, letting the loop walk past the buffer on the next iteration. Reject t_len < 1 up front, mirroring the equivalent guard already present in ipa_ccm_idtag_parse_off(). Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Related: OS#7050 --- M src/gsm/ipa.c 1 file changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/31/43231/1 diff --git a/src/gsm/ipa.c b/src/gsm/ipa.c index d554faf..50fa31f 100644 --- a/src/gsm/ipa.c +++ b/src/gsm/ipa.c @@ -174,6 +174,12 @@ t_len = *cur++; t_tag = *cur++; + if (t_len < 1) { + LOGPC(DLMI, LOGL_DEBUG, "\n"); + LOGP(DLMI, LOGL_ERROR, "The tag length is too short: %d < 1\n", t_len); + return -EINVAL; + } + if (t_len > len + 1) { LOGPC(DLMI, LOGL_DEBUG, "\n"); LOGP(DLMI, LOGL_ERROR, "The tag does not fit: %d > %d\n", t_len, len + 1); @@ -216,6 +222,12 @@ cur += 2; t_tag = *cur++; + if (t_len < 1) { + LOGPC(DLMI, LOGL_DEBUG, "\n"); + LOGP(DLMI, LOGL_ERROR, "The tag length is too short: %d < 1\n", t_len); + return -EINVAL; + } + if (t_len > len + 1) { LOGPC(DLMI, LOGL_DEBUG, "\n"); LOGP(DLMI, LOGL_ERROR, "The tag does not fit: %d > %d\n", t_len, len + 1); -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43231?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ic8e791dc588aec2aa4825ed92c51f86502b370a3 Gerrit-Change-Number: 43231 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: dexter, laforge. pespin has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... Patch Set 1: Code-Review-1 (1 comment) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/dfc37ce7_f75c1695?usp… : PS1, Line 172: if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > SGS_MME_NAME_LEN) Please instead pass mme_name buffer size as a parameter to the function. -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 15:45:12 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-msc[master]: sgs_iface: guard against over-long MME name IEs.
by dexter 14 Aug '26

14 Aug '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email ) Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... sgs_iface: guard against over-long MME name IEs. The function decode_mme_name decodes the MME name from the given tlv_parsed struct a buffer referenced by mme_name. Since the maximum length of the MME name is fixed, the length of the output buffer is also fixed (SGS_MME_NAME_LEN bytes + 1 byte string terminator). Unfortunately the function does not guard against over-long input. When the SGSAP_IE_MME_NAME IE is longer than SGS_MME_NAME_LEN, then either memcpy or osmo_apn_to_str may overflow the output buffer. Bug reported by: adam.bedard(a)gmail.com Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Related: OS#7058 --- M src/libmsc/sgs_iface.c 1 file changed, 4 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/29/43229/1 diff --git a/src/libmsc/sgs_iface.c b/src/libmsc/sgs_iface.c index 178aa64..ddd96b9 100644 --- a/src/libmsc/sgs_iface.c +++ b/src/libmsc/sgs_iface.c @@ -168,6 +168,10 @@ if (!mme_name_enc) return -EINVAL; + /* do not accept IEs which exceed SGS_MME_NAME_LEN */ + if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > SGS_MME_NAME_LEN) + return -EINVAL; + /* some implementations use FDQN format violating TS 29.118 9.3.14 */ if (!osmo_parse_mme_domain(&gummei, (const char *) mme_name_enc)) { memcpy(mme_name, mme_name_enc, TLVP_LEN(tp, SGSAP_IE_MME_NAME)); -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026