pespin has uploaded this change for review.

View Change

xua_rkm: rx REG REQ: Fix potential assert reading optional rctx IE

RFC4666 3.6.1 clearly marks the IE as optional. Our exisitng logic also
expected that the routing key may not be there.

Related: OS#7074
Reported-By: Tristan Madani <tristan@talencesecurity.com>
Change-Id: I0dd6b2892f9ffa72880f98d03e13f0b354c47c61
---
M src/xua_rkm.c
1 file changed, 4 insertions(+), 2 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/96/43396/1

diff --git a/src/xua_rkm.c b/src/xua_rkm.c
index 61730db..ec898d2 100644
--- a/src/xua_rkm.c
+++ b/src/xua_rkm.c
@@ -175,6 +175,7 @@
 			   struct msgb *resp, struct osmo_ss7_as **newly_assigned_as,
 			   unsigned int max_nas_idx, unsigned int *nas_idx)
 {
+	struct xua_msg_part *rctx_ie;
 	uint32_t rk_id, rctx, _tmode, dpc;
 	enum osmo_ss7_as_traffic_mode tmode;
 	struct osmo_ss7_as *as = NULL;
@@ -186,7 +187,7 @@
 	/* mandatory local routing key ID */
 	rk_id = xua_msg_get_u32(inner, M3UA_IEI_LOC_RKEY_ID);
 	/* ASP may already include a routing context value here */
-	rctx = xua_msg_get_u32(inner, M3UA_IEI_ROUTE_CTX);
+	rctx_ie = xua_msg_find_tag(inner, M3UA_IEI_ROUTE_CTX);
 
 	/* traffic mode type (0 = undefined) */
 	_tmode = xua_msg_get_u32(inner, M3UA_IEI_TRAF_MODE_TYP);
@@ -229,8 +230,9 @@
 	 *    all AS/RK in situations where the peers are trusted.
 	 */
 
-	if (rctx) {
+	if (rctx_ie) {
 		/* check if there is already an AS for this routing key */
+		rctx = xua_msg_part_get_u32(rctx_ie);
 		as = osmo_ss7_as_find_by_rctx(asp->inst, rctx);
 	} else {
 		/* if the ASP did not include a routing context number, allocate

To view, visit change 43396. To unsubscribe, or for help writing mail filters, visit settings.