Attention is currently required from: dexter, laforge. pespin has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email )
Change subject: sgs_iface: guard against over-long MME name IEs. ...................................................................... Patch Set 2: (4 comments) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/50b589bf_e14cafa9?usp=email : PS2, Line 165: const uint8_t *mme_name_enc = TLVP_VAL_MINLEN(tp, SGSAP_IE_MME_NAME, SGS_MME_NAME_LEN); so is the TLV value actually expected to be at least SGS_MME_NAME_LEN? Is that correct? https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/91fad0c1_c34dfbda?usp=email : PS2, Line 173: if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) > mme_name_len - 1) "if (TLVP_LEN(tp, SGSAP_IE_MME_NAME) >= mme_name_len)" looks a lot easier to read to me but fine :) https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/732193ee_373b2e24?usp=email : PS2, Line 179: return 0; I'd store TLVP_LEN(tp, SGSAP_IE_MME_NAME) in some len and add an extra mme_name[len] = '\0' here so that we make sure it ends up NULL terminated in this function. https://gerrit.osmocom.org/c/osmo-msc/+/43229/comment/bfd8e1c3_1f7f1df5?usp=email : PS2, Line 183: osmo_apn_to_str(mme_name, TLVP_VAL(tp, SGSAP_IE_MME_NAME), TLVP_LEN(tp, SGSAP_IE_MME_NAME)); isn't "TLVP_VAL(tp, SGSAP_IE_MME_NAME)" here just "mme_name_enc" ? -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43229?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9e845ad1568cb3a88c90f81655c30cac862f83ec Gerrit-Change-Number: 43229 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <[email protected]> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <[email protected]> Gerrit-Reviewer: pespin <[email protected]> Gerrit-Attention: laforge <[email protected]> Gerrit-Attention: dexter <[email protected]> Gerrit-Comment-Date: Thu, 13 Aug 2026 16:41:29 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No
