Change in osmo-msc[master]: smpp_mirror: Don't allocated msgb's for unrealistic amounts of memory

[laforge]

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-msc/+/25934 )


Change subject: smpp_mirror: Don't allocated msgb's for unrealistic amounts of memory
......................................................................

smpp_mirror: Don't allocated msgb's for unrealistic amounts of memory

If the remote ESME would send us 0xffffffff as length field, don't try
to allocte 4GB of memory, but bail out.

Change-Id: I561f75210811826de06ea1673eca1df24faaa210
Fixes: CID#240738
---
M src/utils/smpp_mirror.c
1 file changed, 5 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/34/25934/1

diff --git a/src/utils/smpp_mirror.c b/src/utils/smpp_mirror.c
index 883c498..72d15e3 100644
--- a/src/utils/smpp_mirror.c
+++ b/src/utils/smpp_mirror.c
@@ -246,6 +246,10 @@
 			esme->read_idx += rc;
 		if (esme->read_idx >= sizeof(uint32_t)) {
 			esme->read_len = ntohl(len);
+			if (esme->read_len > 65535) {
+				/* unrealistic */
+				goto dead_socket;
+			}
 			msg = msgb_alloc(esme->read_len, "SMPP Rx");
 			if (!msg)
 				return -ENOMEM;
@@ -283,6 +287,7 @@
 	osmo_fd_unregister(&esme->wqueue.bfd);
 	close(esme->wqueue.bfd.fd);
 	esme->wqueue.bfd.fd = -1;
+	esme_read_state_reset(esme);
 	exit(2342);
 
 	return 0;

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/25934
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-Change-Id: I561f75210811826de06ea1673eca1df24faaa210
Gerrit-Change-Number: 25934
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <laforge at osmocom.org>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20211025/58d423ee/attachment.htm>