laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43890?usp=email ) Change subject: Gb: ensure a BSSGP Tx Status don't overflow on too big messages ...................................................................... Gb: ensure a BSSGP Tx Status don't overflow on too big messages When sending a BSSGP Status, ensure the containing message don't overflow the new message. TS 48.018 specifies the BSSGP layer should take the lower layer MTU into account. However this is the legacy code, keep it simple and ensure it doesn't try to overflow the new message. The newer BSSGP code already handles this in a better way. Reported-by: tsato Fixes: OS#7096 Change-Id: I427d23887dcc05705228b553428d14fda086b06f --- M src/gb/gprs_bssgp_util.c M tests/gb/gprs_bssgp_test.c M tests/gb/gprs_bssgp_test.ok 3 files changed, 48 insertions(+), 1 deletion(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved pespin: Looks good to me, but someone else must approve diff --git a/src/gb/gprs_bssgp_util.c b/src/gb/gprs_bssgp_util.c index 92896c1..8673584 100644 --- a/src/gb/gprs_bssgp_util.c +++ b/src/gb/gprs_bssgp_util.c @@ -584,7 +584,8 @@ msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci); } msgb_tvlv_put(msg, BSSGP_IE_PDU_IN_ERROR, - msgb_bssgp_len(orig_msg), msgb_bssgph(orig_msg)); + OSMO_MIN(msgb_bssgp_len(orig_msg), msgb_tailroom(msg) - 3), /* Tag: 1 byte, Length: 2 bytes */ + msgb_bssgph(orig_msg)); return bssgp_ns_send(bssgp_ns_send_data, msg); } diff --git a/tests/gb/gprs_bssgp_test.c b/tests/gb/gprs_bssgp_test.c index 775ae43..4ae8315 100644 --- a/tests/gb/gprs_bssgp_test.c +++ b/tests/gb/gprs_bssgp_test.c @@ -289,6 +289,49 @@ printf("----- %s END\n", __func__); } + +static struct msgb *_msg_too_big = NULL; +static int _test_bssgp_tx_status_too_big_gprs_ns_sendmsg(void *ctx, struct msgb *msg) +{ + _msg_too_big = msg; + return 0; +} + +/* test if bssgp_tx_status() can handle tooo big messages */ +static void test_bssgp_tx_status_too_big(void) +{ + struct msgb *msg; + struct bssgp_normal_hdr *bgph; + + uint16_t bvci = htons(4); + + bssgp_set_bssgp_callback(_test_bssgp_tx_status_too_big_gprs_ns_sendmsg, NULL); + + printf("----- %s START\n", __func__); + msg = msgb_alloc_headroom(8096, 128, "testtoobig"); + OSMO_ASSERT(msg != NULL); + + /* fill a dummy BSSGP header */ + msgb_bssgph(msg) = msg->data; + bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph)); + msgb_nsei(msg) = 23; + msgb_bvci(msg) = 42; /* ns bvci */ + msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &bvci); + bgph->pdu_type = BSSGP_PDUT_FLUSH_LL; + msgb_put(msg, 5120); + + bssgp_tx_status(BSSGP_CAUSE_INV_MAND_INF, &bvci, msg); + + OSMO_ASSERT(_msg_too_big); + OSMO_ASSERT(msgb_nsei(_msg_too_big) == 23); + OSMO_ASSERT(msgb_bvci(_msg_too_big) == 0); /* BVCI is 0 for STATUS in most cases. see exceptions */ + msgb_free(msg); + msgb_free(_msg_too_big); + + printf("----- %s END\n", __func__); +} + + static struct log_info info = {}; int main(int argc, char **argv) @@ -317,6 +360,7 @@ test_bssgp_bad_reset(); test_bssgp_flow_control_bvc(); test_bssgp_msgb_copy(); + test_bssgp_tx_status_too_big(); printf("===== BSSGP test END\n\n"); exit(EXIT_SUCCESS); diff --git a/tests/gb/gprs_bssgp_test.ok b/tests/gb/gprs_bssgp_test.ok index c5b3e7d..e11a94a 100644 --- a/tests/gb/gprs_bssgp_test.ok +++ b/tests/gb/gprs_bssgp_test.ok @@ -17,5 +17,7 @@ Old msgb: [L3]> 22 04 82 00 02 07 81 08 New msgb: [L3]> 22 04 82 00 02 07 81 08 ----- test_bssgp_msgb_copy END +----- test_bssgp_tx_status_too_big START +----- test_bssgp_tx_status_too_big END ===== BSSGP test END -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I427d23887dcc05705228b553428d14fda086b06f Gerrit-Change-Number: 43890 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis@fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge@osmocom.org> Gerrit-Reviewer: pespin <pespin@sysmocom.de>