Attention is currently required from: fixeria, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email )
Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... Patch Set 1: (1 comment) File src/m3ua.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216/comment/812c88e8_70cac28d?usp=email : PS1, Line 503: npar->info_string = talloc_strdup(ctx, xua_msg_part_get_str(info_ie)); Reading https://talloc.samba.org/talloc/doc/html/group__talloc__string.html#gaca866b920e3b876b00946027244cdd8f I don't understand how this solves the problem. Wouldn't it just run strlen() on info_ie, reading past the end of the "string" if it does not have the null char? Wouldn't it be better to reject strings without \0 at the end here, because the "info_string" name implies that it is a string and other code is likely to assume that it is zero-terminated? -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <[email protected]> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <[email protected]> Gerrit-Reviewer: laforge <[email protected]> Gerrit-Reviewer: osmith <[email protected]> Gerrit-Attention: pespin <[email protected]> Gerrit-Attention: fixeria <[email protected]> Gerrit-Comment-Date: Thu, 13 Aug 2026 13:25:11 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No
