Change in openbsc[master]: bsc-nat: find_paging: Check return code of tlv_parse

[Pau Espin Pedrol]

Pau Espin Pedrol has uploaded this change for review. ( https://gerrit.osmocom.org/9775


Change subject: bsc-nat: find_paging: Check return code of tlv_parse
......................................................................

bsc-nat: find_paging: Check return code of tlv_parse

Change-Id: Ib03681cf91550846af0d487c11cc90b6f700b340
---
M openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
1 file changed, 7 insertions(+), 1 deletion(-)



  git pull ssh://gerrit.osmocom.org:29418/openbsc refs/changes/75/9775/1

diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
index 5a06d3f..85fc7ed 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat_utils.c
@@ -331,13 +331,19 @@
 	int data_length;
 	const uint8_t *data;
 	struct tlv_parsed tp;
+	int rc;
 
 	if (!msg->l3h || msgb_l3len(msg) < 3) {
 		LOGP(DNAT, LOGL_ERROR, "Paging message is too short.\n");
 		return -1;
 	}
 
-	tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 3, msgb_l3len(msg) - 3, 0, 0);
+	rc = tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 3, msgb_l3len(msg) - 3, 0, 0);
+	if (rc < 0) {
+		LOGP(DNAT, LOGL_ERROR, "Failed parsing PAGING TLV -- discarding message! %s\n",
+			osmo_hexdump(msg->l3h, msgb_l3len(msg)));
+		return -1;
+	}
 	if (!TLVP_PRESENT(&tp, GSM0808_IE_CELL_IDENTIFIER_LIST)) {
 		LOGP(DNAT, LOGL_ERROR, "No CellIdentifier List inside paging msg.\n");
 		return -2;

-- 
To view, visit https://gerrit.osmocom.org/9775
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: openbsc
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ib03681cf91550846af0d487c11cc90b6f700b340
Gerrit-Change-Number: 9775
Gerrit-PatchSet: 1
Gerrit-Owner: Pau Espin Pedrol <pespin at sysmocom.de>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20180628/73636e02/attachment.htm>