Attention is currently required from: pespin, fixeria. laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/27620 )

Change subject: abis_rsl: always check return value of rsl_tlv_parse() ......................................................................

Patch Set 1: Code-Review+1

(1 comment)

File src/osmo-bsc/abis_rsl.c:

https://gerrit.osmocom.org/c/osmo-bsc/+/27620/comment/9073e797_aaec0ecc PS1, Line 1224: if (rsl_tlv_parse(&tp, dh->data, msgb_l2len(msg) - sizeof(*dh)) < 0) {

You probably need to check that msgb_l2len(msg) >= sizeof(*dh) before derreferencing dh below. […]

abis_rsl_rcvmsg() is checking for 'sizeof(struct abis_rsl_common_hdr)' length. Since only dh->c ('c' is the common part) is dereferenced, it's fine.

However, I think the check for the larger 'sizeof(struct abis_rsl_rx_dchan)' should go into the start of abis_rsl_rx_dchan(), whre we already dereference the chan_nr information element. Unrelated additional patch.