Change in osmo-bts[master]: OML: Properly reject short messages and truncate over-long messages

[Harald Welte]

Harald Welte has uploaded this change for review. ( https://gerrit.osmocom.org/12873


Change subject: OML: Properly reject short messages and truncate over-long messages
......................................................................

OML: Properly reject short messages and truncate over-long messages

For OML, what matters is the length indicated in the OML message header.

If we don't have sufficient bytes, reject the message and send a failure
event report.

If we have more bytes, truncate the message at the number of bytes
indicated in the OML length header.

Change-Id: Ib98f0d7c2cff9172714ed18667c02564540d65d7
---
M src/common/oml.c
1 file changed, 15 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.osmocom.org:29418/osmo-bts refs/changes/73/12873/1

diff --git a/src/common/oml.c b/src/common/oml.c
index 4697086..1de8054 100644
--- a/src/common/oml.c
+++ b/src/common/oml.c
@@ -1438,6 +1438,21 @@
 		return -EIO;
 	}
 
+	if (msgb_l3len(msg) < oh->length) {
+		oml_tx_failure_event_rep(&bts->mo, OSMO_EVT_MAJ_UKWN_MSG,
+					 "Short OML message: %u < %u\n",
+					 msgb_l3len(msg), oh->length);
+		msgb_free(msg);
+		return -EIO;
+	}
+
+	if (msgb_l3len(msg) > oh->length) {
+		LOGP(DOML, LOGL_NOTICE, "OML message with %u extraneous bytes at end: %s\n",
+			msgb_l3len(msg) - oh->length, msgb_hexdump(msg));
+		/* remove extra bytes at end */
+		msgb_l3trim(msg, oh->length);
+	}
+
 	switch (oh->mdisc) {
 	case ABIS_OM_MDISC_FOM:
 		if (msgb_l2len(msg) < sizeof(*oh)) {

-- 
To view, visit https://gerrit.osmocom.org/12873
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ib98f0d7c2cff9172714ed18667c02564540d65d7
Gerrit-Change-Number: 12873
Gerrit-PatchSet: 1
Gerrit-Owner: Harald Welte <laforge at gnumonks.org>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20190209/a78c091b/attachment.htm>