Attention is currently required from: fixeria.
laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email )
Change subject: sua: fix buffer overflow in sua_parse_gt()
......................................................................
Patch Set 1: Code-Review+1
(1 comment)
Patchset:
PS1:
I think it would be prudent to give credit to the reporter of the bug in the commitlog.
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f
Gerrit-Change-Number: 43228
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Comment-Date: Thu, 13 Aug 2026 14:23:07 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email )
Change subject: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify()
......................................................................
m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify()
In theory user should have a look at npar->presence before accessing
those fields, but in case it is somewhere forgotten then best having
some initialized values, specially in the route_ctx_count which could
turn into buffer overflows or reading more garbage from uninitialized
array members.
Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751
---
M src/m3ua.c
1 file changed, 4 insertions(+), 0 deletions(-)
Approvals:
osmith: Looks good to me, but someone else must approve
laforge: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/src/m3ua.c b/src/m3ua.c
index 39402fd..f2455eb 100644
--- a/src/m3ua.c
+++ b/src/m3ua.c
@@ -484,6 +484,8 @@
if (aspid_ie) {
npar->asp_id = xua_msg_part_get_u32(aspid_ie);
npar->presence |= NOTIFY_PAR_P_ASP_ID;
+ } else {
+ npar->asp_id = 0;
}
if (rctx_ie) {
@@ -502,6 +504,8 @@
for (unsigned int i = 0; i < npar->route_ctx_count; i++)
npar->route_ctx[i] = ntohl(*(uint32_t *)&rctx_ie->dat[i << 2]);
npar->presence |= NOTIFY_PAR_P_ROUTE_CTX;
+ } else {
+ npar->route_ctx_count = 0;
}
if (info_ie)
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751
Gerrit-Change-Number: 43221
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43222?usp=email )
Change subject: xua: Avoid OOB read of Routing Context with len < 4
......................................................................
xua: Avoid OOB read of Routing Context with len < 4
Change-Id: If19f210c8d6a308f99b4f06fdc06581ffdc62696
---
M src/xua_shared.c
1 file changed, 5 insertions(+), 0 deletions(-)
Approvals:
laforge: Looks good to me, approved
Jenkins Builder: Verified
osmith: Looks good to me, but someone else must approve
diff --git a/src/xua_shared.c b/src/xua_shared.c
index 51cbbf2..53b7337 100644
--- a/src/xua_shared.c
+++ b/src/xua_shared.c
@@ -42,6 +42,7 @@
/* this is why we can use the M3UA constants below in a function shared between M3UA + SUA */
osmo_static_assert(M3UA_ERR_INVAL_ROUT_CTX == SUA_ERR_INVAL_ROUT_CTX, _err_rctx);
osmo_static_assert(M3UA_ERR_NO_CONFGD_AS_FOR_ASP == SUA_ERR_NO_CONFGD_AS_FOR_ASP, _err_as_for_asp);
+osmo_static_assert(M3UA_ERR_PARAM_FIELD_ERR == SUA_ERR_PARAM_FIELD_ERR, _err_param_field_err);
/*! Find the AS for given ASP + optional routing context IE.
* if rctx_ie == NULL, we assume that this ASP is only part of a single AS;
@@ -58,6 +59,10 @@
*as = NULL;
if (rctx_ie) {
+ if (rctx_ie->len < 4) {
+ LOGPASP(asp, log_ss, LOGL_ERROR, "%s(): Received Routing Context with len < 4\n", __func__);
+ return M3UA_ERR_PARAM_FIELD_ERR;
+ }
/* Use routing context IE to look up the AS for which the
* message was received. */
uint32_t rctx = xua_msg_part_get_u32(rctx_ie);
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43222?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: If19f210c8d6a308f99b4f06fdc06581ffdc62696
Gerrit-Change-Number: 43222
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email )
Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
......................................................................
m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
Despite RFC4666 states it can contain "any meaningful UTF-8 character
string", it also states that the string can be 0 bytes, which implicitly
means a string could come without null char at the end.
In any case, it's good practice to guard against it, as already done in
all the other libosmo-sigtran code.
Related: OS#7056
Reported-By: Adam Bedard <adam.bedard(a)gmail.com>
Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4
---
M src/m3ua.c
1 file changed, 3 insertions(+), 4 deletions(-)
Approvals:
Jenkins Builder: Verified
laforge: Looks good to me, but someone else must approve
osmith: Looks good to me, approved
diff --git a/src/m3ua.c b/src/m3ua.c
index 583800b..69b4438 100644
--- a/src/m3ua.c
+++ b/src/m3ua.c
@@ -499,10 +499,9 @@
npar->presence |= NOTIFY_PAR_P_ROUTE_CTX;
}
- if (info_ie) {
- npar->info_string = talloc_size(ctx, info_ie->len);
- memcpy(npar->info_string, info_ie->dat, info_ie->len);
- } else
+ if (info_ie)
+ npar->info_string = talloc_strdup(ctx, xua_msg_part_get_str(info_ie));
+ else
npar->info_string = NULL;
return 0;
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4
Gerrit-Change-Number: 43216
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43217?usp=email )
(
1 is the latest approved patch-set.
No files were changed between the latest approved patch-set and the submitted one.
)Change subject: xua_snm.c: Use M3UA IE define when shared with SUA IE
......................................................................
xua_snm.c: Use M3UA IE define when shared with SUA IE
We use everywhere the M3UA IE define when both the M3UA and SUA IE are
equivalent (for those IEs the SUA define points to the M3UA, and
osmo_static_assert() are placed at the start of the file).
Change-Id: Ie15e5a179b65afc7a0d1cbe145cce4cf2556c877
---
M src/xua_snm.c
1 file changed, 2 insertions(+), 2 deletions(-)
Approvals:
laforge: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/src/xua_snm.c b/src/xua_snm.c
index a2e4fde..2abc42e 100644
--- a/src/xua_snm.c
+++ b/src/xua_snm.c
@@ -552,8 +552,8 @@
/* an incoming SUA/M3UA DUPU was received from a remote SG */
void xua_snm_rx_dupu(struct osmo_ss7_asp *asp, struct osmo_ss7_as *as, struct xua_msg *xua)
{
- uint32_t aff_pc = xua_msg_get_u32(xua, SUA_IEI_AFFECTED_PC);
- const char *info_str = xua_msg_get_str(xua, SUA_IEI_INFO_STRING);
+ uint32_t aff_pc = xua_msg_get_u32(xua, M3UA_IEI_AFFECTED_PC);
+ const char *info_str = xua_msg_get_str(xua, M3UA_IEI_INFO_STRING);
/* TODO: should our processing depend on the RCTX included? I somehow don't think so */
//struct xua_msg_part *ie_rctx = xua_msg_find_tag(xua, SUA_IEI_ROUTE_CTX);
int log_ss = osmo_ss7_asp_get_log_subsys(asp);
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43217?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: Ie15e5a179b65afc7a0d1cbe145cce4cf2556c877
Gerrit-Change-Number: 43217
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Attention is currently required from: dexter, jolly, laforge.
jwaigel has posted comments on this change by jwaigel. ( https://gerrit.osmocom.org/c/pysim/+/43205?usp=email )
Change subject: osmo-smdpp: derive the Profile Metadata from the Profile
......................................................................
Patch Set 3:
(1 comment)
File osmo-smdpp.py:
https://gerrit.osmocom.org/c/pysim/+/43205/comment/dbce66ab_0d7ee0eb?usp=em… :
PS2, Line 638: # look up profile based on matchingID. We simply check if a given file exists for now..
> I don't like that the 'if matchingId' (or alternatively an 'else' clause) has been removed here. […]
Restored the second branch, thanks.
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/43205?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: Ie24dd5ac0ef541c1899dd923a9db568209bbfa62
Gerrit-Change-Number: 43205
Gerrit-PatchSet: 3
Gerrit-Owner: jwaigel <johannes(a)waigel.me>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: jolly <andreas(a)eversberg.eu>
Gerrit-CC: laforge <laforge(a)osmocom.org>
Gerrit-CC: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: jolly <andreas(a)eversberg.eu>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
Gerrit-Comment-Date: Thu, 13 Aug 2026 14:14:34 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: laforge <laforge(a)osmocom.org>