falconia has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bts/+/36908?usp=email ) Change subject: rsl: parse RSL_IE_OSMO_OSMUX_CID correctly ...................................................................... rsl: parse RSL_IE_OSMO_OSMUX_CID correctly This IE has TLV format, even though the only valid form is a single value octet. To guard against pathological input with L=0 in this IE, we have to check the length explicitly with TLVP_PRES_LEN before accepting TLVP_VAL as if it was TV. Change-Id: I15fa75b6c30d7fa0bf50424d25fc47a088dada0a --- M src/common/rsl.c 1 file changed, 19 insertions(+), 2 deletions(-) Approvals: pespin: Looks good to me, approved Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve diff --git a/src/common/rsl.c b/src/common/rsl.c index fa5f495..40690f0 100644 --- a/src/common/rsl.c +++ b/src/common/rsl.c @@ -2978,7 +2978,8 @@ struct tlv_parsed tp; struct gsm_lchan *lchan = msg->lchan; struct gsm_bts *bts = lchan->ts->trx->bts; - const uint8_t *payload_type, *speech_mode, *payload_type2, *osmux_cid, *csd_fmt; + const uint8_t *payload_type, *speech_mode, *payload_type2, *csd_fmt; + const uint8_t *osmux_cid = NULL; uint32_t connect_ip = 0; uint16_t connect_port = 0; int rc, inc_ip_port = 0; @@ -3029,7 +3030,9 @@ if (payload_type2) LOGPC(DRSL, LOGL_DEBUG, "payload_type2=%u ", *payload_type2); - osmux_cid = TLVP_VAL(&tp, RSL_IE_OSMO_OSMUX_CID); + /* this IE has TLV format when TV would have been good enough */ + if (TLVP_PRES_LEN(&tp, RSL_IE_OSMO_OSMUX_CID, 1)) + osmux_cid = TLVP_VAL(&tp, RSL_IE_OSMO_OSMUX_CID); if (osmux_cid) LOGPC(DRSL, LOGL_DEBUG, "osmux_cid=%u ", *osmux_cid); -- To view, visit https://gerrit.osmocom.org/c/osmo-bts/+/36908?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-bts Gerrit-Branch: master Gerrit-Change-Id: I15fa75b6c30d7fa0bf50424d25fc47a088dada0a Gerrit-Change-Number: 36908 Gerrit-PatchSet: 2 Gerrit-Owner: falconia <falcon(a)freecalypso.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: falconia <falcon(a)freecalypso.org> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged