pespin has uploaded this change for review. (
https://gerrit.osmocom.org/c/libosmo-sigtran/+/43410?usp=email )
Change subject: mtp3_rtpc: Fix potential assert getting rcxt_ie->len < 4
......................................................................
mtp3_rtpc: Fix potential assert getting rcxt_ie->len < 4
If an incoming message which contains an unbounded Routing Context IE,
it may be that it comes malformed and hence len is < 4. In that case,
xua_msg_part_get_u32() would have hit an ASSERT.
Fix the problem by simply passing by the whole Routing Context
(removing non-multiple of 4 potential churn at the end), since anyway we
should be sending the same whole set of Routing Contexts we received.
Change-Id: Ia0a8dd4907d6ad786e9cc257d299a1521dd45dee
---
M src/mtp3_rtpc.c
1 file changed, 4 insertions(+), 4 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran
refs/changes/10/43410/1
diff --git a/src/mtp3_rtpc.c b/src/mtp3_rtpc.c
index 34d40e7..a1a8856 100644
--- a/src/mtp3_rtpc.c
+++ b/src/mtp3_rtpc.c
@@ -42,14 +42,14 @@
struct xua_msg *xua;
struct xua_msg_part *rctx_ie;
unsigned int num_rctx = 0;
- uint32_t rctx = 0;
+ uint32_t *rctx_raw = NULL;
uint32_t aff_pc = htonl(orig_xua->mtp.dpc);
if ((rctx_ie = xua_msg_find_tag(orig_xua, M3UA_IEI_ROUTE_CTX))) {
- rctx = xua_msg_part_get_u32(rctx_ie);
- num_rctx = 1;
+ rctx_raw = (uint32_t *) rctx_ie->dat;
+ num_rctx = rctx_ie->len / sizeof(uint32_t);
}
- xua = m3ua_encode_duna(&rctx, num_rctx, &aff_pc, 1,
+ xua = m3ua_encode_duna(rctx_raw, num_rctx, &aff_pc, 1,
"transfer prohibited (inaccessible SP)");
OSMO_ASSERT(xua);
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43410?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: Ia0a8dd4907d6ad786e9cc257d299a1521dd45dee
Gerrit-Change-Number: 43410
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <[email protected]>
