laforge submitted this change.

View Change

Gb: ensure a BSSGP Tx Status don't overflow on too big messages

When sending a BSSGP Status, ensure the containing message don't
overflow the new message.
TS 48.018 specifies the BSSGP layer should take the lower layer
MTU into account. However this is the legacy code, keep it simple
and ensure it doesn't try to overflow the new message.

The newer BSSGP code already handles this in a better way.

Reported-by: tsato
Fixes: OS#7096
Change-Id: I427d23887dcc05705228b553428d14fda086b06f
---
M src/gb/gprs_bssgp_util.c
M tests/gb/gprs_bssgp_test.c
M tests/gb/gprs_bssgp_test.ok
3 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/src/gb/gprs_bssgp_util.c b/src/gb/gprs_bssgp_util.c
index 92896c1..8673584 100644
--- a/src/gb/gprs_bssgp_util.c
+++ b/src/gb/gprs_bssgp_util.c
@@ -584,7 +584,8 @@
 		msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
 	}
 	msgb_tvlv_put(msg, BSSGP_IE_PDU_IN_ERROR,
-		      msgb_bssgp_len(orig_msg), msgb_bssgph(orig_msg));
+		      OSMO_MIN(msgb_bssgp_len(orig_msg), msgb_tailroom(msg) - 3), /* Tag: 1 byte, Length: 2 bytes */
+		      msgb_bssgph(orig_msg));
 
 	return bssgp_ns_send(bssgp_ns_send_data, msg);
 }
diff --git a/tests/gb/gprs_bssgp_test.c b/tests/gb/gprs_bssgp_test.c
index 775ae43..4ae8315 100644
--- a/tests/gb/gprs_bssgp_test.c
+++ b/tests/gb/gprs_bssgp_test.c
@@ -289,6 +289,49 @@
 	printf("----- %s END\n", __func__);
 }
 
+
+static struct msgb *_msg_too_big = NULL;
+static int _test_bssgp_tx_status_too_big_gprs_ns_sendmsg(void *ctx, struct msgb *msg)
+{
+	_msg_too_big = msg;
+	return 0;
+}
+
+/* test if bssgp_tx_status() can handle tooo big messages */
+static void test_bssgp_tx_status_too_big(void)
+{
+	struct msgb *msg;
+	struct bssgp_normal_hdr *bgph;
+
+	uint16_t bvci = htons(4);
+
+	bssgp_set_bssgp_callback(_test_bssgp_tx_status_too_big_gprs_ns_sendmsg, NULL);
+
+	printf("----- %s START\n", __func__);
+	msg = msgb_alloc_headroom(8096, 128, "testtoobig");
+	OSMO_ASSERT(msg != NULL);
+
+	/* fill a dummy BSSGP header */
+	msgb_bssgph(msg) = msg->data;
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	msgb_nsei(msg) = 23;
+	msgb_bvci(msg) = 42; /* ns bvci */
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &bvci);
+	bgph->pdu_type = BSSGP_PDUT_FLUSH_LL;
+	msgb_put(msg, 5120);
+
+	bssgp_tx_status(BSSGP_CAUSE_INV_MAND_INF, &bvci, msg);
+
+	OSMO_ASSERT(_msg_too_big);
+	OSMO_ASSERT(msgb_nsei(_msg_too_big) == 23);
+	OSMO_ASSERT(msgb_bvci(_msg_too_big) == 0); /* BVCI is 0 for STATUS in most cases. see exceptions */
+	msgb_free(msg);
+	msgb_free(_msg_too_big);
+
+	printf("----- %s END\n", __func__);
+}
+
+
 static struct log_info info = {};
 
 int main(int argc, char **argv)
@@ -317,6 +360,7 @@
 	test_bssgp_bad_reset();
 	test_bssgp_flow_control_bvc();
 	test_bssgp_msgb_copy();
+	test_bssgp_tx_status_too_big();
 	printf("===== BSSGP test END\n\n");
 
 	exit(EXIT_SUCCESS);
diff --git a/tests/gb/gprs_bssgp_test.ok b/tests/gb/gprs_bssgp_test.ok
index c5b3e7d..e11a94a 100644
--- a/tests/gb/gprs_bssgp_test.ok
+++ b/tests/gb/gprs_bssgp_test.ok
@@ -17,5 +17,7 @@
 Old msgb: [L3]> 22 04 82 00 02 07 81 08 
 New msgb: [L3]> 22 04 82 00 02 07 81 08 
 ----- test_bssgp_msgb_copy END
+----- test_bssgp_tx_status_too_big START
+----- test_bssgp_tx_status_too_big END
 ===== BSSGP test END
 

To view, visit change 43890. To unsubscribe, or for help writing mail filters, visit settings.