This is merely a historical archive of years 2008-2021, before the migration to mailman3.
A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.
Neels Hofmeyr gerrit-no-reply at lists.osmocom.orgReview at https://gerrit.osmocom.org/1662 gsm0408_rcv_cc: guard against NULL subscriber Check conn->subscr against NULL. gsm0408_rcv_cc() dereferences many conn members without checking presence: the bts and lchan members may be expected to be NULL in the ongoing MSC split and 3G developments. But the conn->subscr is initially NULL, so an MS sending a CC message before something like a LU or CM Service Request will result in a segfault. Prevent that. Note: the upcoming VLR will be more restrictive on what messages are processed, this is a "backport" to the situation on current master. Change-Id: If067db7cc0dd3210d9eb1da15be6b637795a3ecf --- M openbsc/src/libmsc/gsm_04_08.c 1 file changed, 5 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/openbsc refs/changes/62/1662/1 diff --git a/openbsc/src/libmsc/gsm_04_08.c b/openbsc/src/libmsc/gsm_04_08.c index 742f803..755aa79 100644 --- a/openbsc/src/libmsc/gsm_04_08.c +++ b/openbsc/src/libmsc/gsm_04_08.c @@ -3605,6 +3605,11 @@ return -EINVAL; } + if (!conn->subscr) { + LOGP(DCC, LOGL_ERROR, "Invalid conn, no subscriber\n"); + return -EINVAL; + } + /* Find transaction */ trans = trans_find_by_id(conn, GSM48_PDISC_CC, transaction_id); -- To view, visit https://gerrit.osmocom.org/1662 To unsubscribe, visit https://gerrit.osmocom.org/settings Gerrit-MessageType: newchange Gerrit-Change-Id: If067db7cc0dd3210d9eb1da15be6b637795a3ecf Gerrit-PatchSet: 1 Gerrit-Project: openbsc Gerrit-Branch: master Gerrit-Owner: Neels Hofmeyr <nhofmeyr at sysmocom.de>