Change in libosmocore[master]: gsm48_mi_to_string(): guard against zero length output buffer

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

Harald Welte gerrit-no-reply at lists.osmocom.org
Mon Dec 10 17:06:32 UTC 2018


Harald Welte has submitted this change and it was merged. ( https://gerrit.osmocom.org/12156 )

Change subject: gsm48_mi_to_string(): guard against zero length output buffer
......................................................................

gsm48_mi_to_string(): guard against zero length output buffer

All successful cases already return from the switch(), so simply handle all
errors below it by returning an empty string (if there is enough string
buffer).

Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571
---
M src/gsm/gsm48.c
M tests/gsm0408/gsm0408_test.ok
2 files changed, 13 insertions(+), 13 deletions(-)

Approvals:
  Harald Welte: Looks good to me, approved
  Pau Espin Pedrol: Looks good to me, approved
  Stefan Sperling: Looks good to me, but someone else must approve
  Jenkins Builder: Verified



diff --git a/src/gsm/gsm48.c b/src/gsm/gsm48.c
index 0f0889b..af3e14c 100644
--- a/src/gsm/gsm48.c
+++ b/src/gsm/gsm48.c
@@ -653,14 +653,11 @@
 {
 	int rc;
 	uint8_t mi_type;
-	char *str_cur = string;
 	uint32_t tmsi;
 
 	mi_type = mi[0] & GSM_MI_TYPE_MASK;
 
 	switch (mi_type) {
-	case GSM_MI_TYPE_NONE:
-		break;
 	case GSM_MI_TYPE_TMSI:
 		/* Table 10.5.4.3, reverse generate_mid_from_tmsi */
 		if (mi_len == GSM48_TMSI_LEN && mi[0] == (0xf0 | GSM_MI_TYPE_TMSI)) {
@@ -680,12 +677,15 @@
 			return rc + 1;
 		else
 			return strlen(string) + 1;
+
 	default:
 		break;
 	}
-	*str_cur++ = '\0';
 
-	return str_cur - string;
+	if (str_len < 1)
+		return 0;
+	*string = '\0';
+	return 1;
 }
 
 /*! Parse TS 04.08 Routing Area Identifier
diff --git a/tests/gsm0408/gsm0408_test.ok b/tests/gsm0408/gsm0408_test.ok
index 6e99f5b..d6579e5 100644
--- a/tests/gsm0408/gsm0408_test.ok
+++ b/tests/gsm0408/gsm0408_test.ok
@@ -72,8 +72,8 @@
     returned empty string
 - MI type: TMSI
   - writing to zero-length string:
-    rc=1
-    ERROR: Wrote to invalid memory!
+    rc=0
+    nothing written
   - writing to 1-byte-length string:
     rc=1
     returned empty string
@@ -82,8 +82,8 @@
     returned empty string
 - MI type: NONE
   - writing to zero-length string:
-    rc=1
-    ERROR: Wrote to invalid memory!
+    rc=0
+    nothing written
   - writing to 1-byte-length string:
     rc=1
     returned empty string
@@ -102,8 +102,8 @@
     returned empty string
 - MI type: TMSI | GSM_MI_ODD
   - writing to zero-length string:
-    rc=1
-    ERROR: Wrote to invalid memory!
+    rc=0
+    nothing written
   - writing to 1-byte-length string:
     rc=1
     returned empty string
@@ -112,8 +112,8 @@
     returned empty string
 - MI type: NONE | GSM_MI_ODD
   - writing to zero-length string:
-    rc=1
-    ERROR: Wrote to invalid memory!
+    rc=0
+    nothing written
   - writing to 1-byte-length string:
     rc=1
     returned empty string

-- 
To view, visit https://gerrit.osmocom.org/12156
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571
Gerrit-Change-Number: 12156
Gerrit-PatchSet: 8
Gerrit-Owner: Neels Hofmeyr <nhofmeyr at sysmocom.de>
Gerrit-Reviewer: Harald Welte <laforge at gnumonks.org>
Gerrit-Reviewer: Jenkins Builder (1000002)
Gerrit-Reviewer: Pau Espin Pedrol <pespin at sysmocom.de>
Gerrit-Reviewer: Stefan Sperling <stsp at stsp.name>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20181210/60b08b87/attachment.htm>


More information about the gerrit-log mailing list