trau_decode_fr memory corruption. Fix requested

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/OpenBSC@lists.osmocom.org/.

Harald Welte laforge at gnumonks.org
Mon Jun 23 07:50:48 UTC 2014


Hi Holger,

On Wed, May 28, 2014 at 04:58:11PM +0200, Holger Hans Peter Freyther wrote:
> I don't really know much about the bit order of TRAU frames but
> the trau_test.c is causing an out of bounds access to the gsm_fr_map.

It is the last iteration of the loop, where i==259 and o==260.  It is
read out-of-bounds but the content is never used.  So yes, it is an
out-of-bounds access, but one that's unlikely to cause any problems
[unless the end of the 'gsm_fr_map' is the edge of the address space]

The only way I can think to avoid it is by putting additional
conditionals in the code, which might have performance implications:

Fixed in git:




More information about the OpenBSC mailing list