Attention is currently required from: laforge, pespin.
Hello Jenkins Builder, laforge, pespin,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Code-Review-1 by pespin, Verified+1 by Jenkins Builder
Change subject: sgs_iface: guard against over-long MME name IEs.
......................................................................
sgs_iface: guard against over-long MME name IEs.
The function decode_mme_name decodes the MME name from the given
tlv_parsed struct a buffer referenced by mme_name. Since the maximum
length of the MME name is fixed, the length of the output buffer is
also fixed (SGS_MME_NAME_LEN bytes + 1 byte string terminator).
Unfortunately the function does not guard against over-long input.
When the SGSAP_IE_MME_NAME IE is longer than SGS_MME_NAME_LEN, then
either memcpy or osmo_apn_to_str may overflow the output buffer.
Bug reported by: [email protected]
Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec
Related: OS#7058
---
M src/libmsc/sgs_iface.c
1 file changed, 7 insertions(+), 2 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/29/43229/2
--
To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec
Gerrit-Change-Number: 43229
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
Gerrit-Attention: laforge <[email protected]>
Gerrit-Attention: pespin <[email protected]>
