Harald Welte has submitted this change and it was merged.

Change subject: osmux: osmux_xfrm_output_pull: Improve checks and log of 
malformed packets
......................................................................


osmux: osmux_xfrm_output_pull: Improve checks and log of malformed packets

Change-Id: I143805bb5ee9f5e3ada46114e380a03ede80df9f
Related: SYS#4182
---
M src/osmux.c
1 file changed, 11 insertions(+), 5 deletions(-)

Approvals:
  Harald Welte: Looks good to me, approved
  Jenkins Builder: Verified



diff --git a/src/osmux.c b/src/osmux.c
index a0563d2..03db469 100644
--- a/src/osmux.c
+++ b/src/osmux.c
@@ -85,8 +85,13 @@
                case OSMUX_FT_VOICE_AMR:
                        break;
                case OSMUX_FT_DUMMY:
-                       msgb_pull(msg, osmux_ft_dummy_size(osmuxh->amr_ft,
-                                                          osmuxh->ctr + 1));
+                       len = osmux_ft_dummy_size(osmuxh->amr_ft, osmuxh->ctr + 
1);
+                       if (msgb_length(msg) < len) {
+                               LOGP(DLMUX, LOGL_ERROR, "Discarding bad Dummy 
FT: %s\n",
+                                       osmo_hexdump(msg->data, 
msgb_length(msg)));
+                               return NULL;
+                       }
+                       msgb_pull(msg, len);
                        goto next;
                default:
                        LOGP(DLMUX, LOGL_ERROR, "Discarding unsupported Osmux 
FT %d\n",
@@ -102,9 +107,10 @@
                len = osmo_amr_bytes(osmuxh->amr_ft) * (osmuxh->ctr+1) +
                        sizeof(struct osmux_hdr);
 
-               if (len > msg->len) {
-                       LOGP(DLMUX, LOGL_ERROR, "Discarding malformed "
-                                               "OSMUX message\n");
+               if (msgb_length(msg) < len) {
+                       LOGP(DLMUX, LOGL_ERROR,
+                               "Discarding malformed OSMUX message: %s\n",
+                               osmo_hexdump(msg->data, msgb_length(msg)));
                        return NULL;
                }
 

-- 
To view, visit https://gerrit.osmocom.org/7783
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I143805bb5ee9f5e3ada46114e380a03ede80df9f
Gerrit-PatchSet: 2
Gerrit-Project: libosmo-netif
Gerrit-Branch: master
Gerrit-Owner: Pau Espin Pedrol <pes...@sysmocom.de>
Gerrit-Reviewer: Harald Welte <lafo...@gnumonks.org>
Gerrit-Reviewer: Jenkins Builder

Reply via email to