This is merely a historical archive of years 2008-2021, before the migration to mailman3.
A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.
osmith gerrit-no-reply at lists.osmocom.orgosmith has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-hlr/+/14399 Change subject: rx_check_imei_req(): fix IMEI bounds checking ...................................................................... rx_check_imei_req(): fix IMEI bounds checking IMEIs (without the checksum) always have 14 digits. Replace the previous check (length <= 14) with a proper one (length == 14) and set the buffer to the right size. I have tested with new TTCN3 tests, that the length check is working properly now. Related: OS#2541 Change-Id: I060a8db98fb882e4815d1709a5d85bc0143a73a6 --- M src/hlr.c 1 file changed, 8 insertions(+), 7 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-hlr refs/changes/99/14399/1 diff --git a/src/hlr.c b/src/hlr.c index 33d2828..32a584e 100644 --- a/src/hlr.c +++ b/src/hlr.c @@ -477,18 +477,19 @@ { struct osmo_gsup_message gsup_reply = {0}; struct msgb *msg_out; - char imei[GSM23003_IMEI_NUM_DIGITS+1] = {0}; + char imei[GSM23003_IMEI_NUM_DIGITS_NO_CHK+1] = {0}; - /* Encoded IMEI length check */ - if (!gsup->imei_enc || gsup->imei_enc_len < 1 || gsup->imei_enc[0] >= sizeof(imei)) { - LOGP(DMAIN, LOGL_ERROR, "%s: wrong encoded IMEI length\n", gsup->imsi); + /* Decode IMEI (fails if IMEI is too long) */ + if (gsm48_decode_bcd_number2(imei, sizeof(imei), gsup->imei_enc, gsup->imei_enc_len, 0) < 0) { + LOGP(DMAIN, LOGL_ERROR, "%s: failed to decode IMEI\n", gsup->imsi); gsup_send_err_reply(conn, gsup->imsi, gsup->message_type, GMM_CAUSE_INV_MAND_INFO); return -1; } - /* Decode IMEI */ - if (gsm48_decode_bcd_number2(imei, sizeof(imei), gsup->imei_enc, gsup->imei_enc_len, 0) < 0) { - LOGP(DMAIN, LOGL_ERROR, "%s: failed to decode IMEI\n", gsup->imsi); + /* Check if IMEI is too short */ + if (strlen(imei) != GSM23003_IMEI_NUM_DIGITS_NO_CHK) { + LOGP(DMAIN, LOGL_ERROR, "%s: wrong encoded IMEI length (IMEI: '%s', %lu, %i)\n", gsup->imsi, imei, + strlen(imei), GSM23003_IMEI_NUM_DIGITS_NO_CHK); gsup_send_err_reply(conn, gsup->imsi, gsup->message_type, GMM_CAUSE_INV_MAND_INFO); return -1; } -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/14399 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I060a8db98fb882e4815d1709a5d85bc0143a73a6 Gerrit-Change-Number: 14399 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith at sysmocom.de> Gerrit-MessageType: newchange -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20190607/0591040f/attachment.htm>