Harald Welte has submitted this change and it was merged. (
https://gerrit.osmocom.org/12873 )
Change subject: OML: Properly reject short messages and truncate over-long
messages
......................................................................
OML: Properly reject short messages and truncate over-long messages
For OML, what matters is the length indicated in the OML message header.
If we don't have sufficient bytes, reject the message and send a failure
event report.
If we have more bytes, truncate the message at the number of bytes
indicated in the OML length header.
Change-Id: Ib98f0d7c2cff9172714ed18667c02564540d65d7
---
M src/common/oml.c
1 file changed, 23 insertions(+), 0 deletions(-)
Approvals:
Pau Espin Pedrol: Looks good to me, but someone else must approve
Harald Welte: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/src/common/oml.c b/src/common/oml.c
index d389e29..8bc31f8 100644
--- a/src/common/oml.c
+++ b/src/common/oml.c
@@ -1087,6 +1087,7 @@
static int down_fom(struct gsm_bts *bts, struct msgb *msg)
{
+ struct abis_om_hdr *oh = msgb_l2(msg);
struct abis_om_fom_hdr *foh = msgb_l3(msg);
struct gsm_bts_trx *trx;
const struct gsm_abis_mo *mo = &bts->mo;
@@ -1100,6 +1101,13 @@
return -EIO;
}
+ if (msgb_l3len(msg) > oh->length) {
+ LOGP(DOML, LOGL_NOTICE, "OML message with %u extraneous bytes
at end: %s\n",
+ msgb_l3len(msg) - oh->length, msgb_hexdump(msg));
+ /* remove extra bytes at end */
+ msgb_l3trim(msg, oh->length);
+ }
+
if (report_bts_number_incorrect(bts, foh, true))
return oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN);
@@ -1383,6 +1391,13 @@
return -EINVAL;
}
+ if (msgb_l3len(msg) > oh->length + 1 + oh->data[0]) {
+ LOGP(DOML, LOGL_NOTICE, "OML message with %u extraneous bytes
at end: %s\n",
+ msgb_l3len(msg) - oh->length, msgb_hexdump(msg));
+ /* remove extra bytes at end */
+ msgb_l3trim(msg, oh->length);
+ }
+
msg->l3h = oh->data + 1 + idstrlen;
foh = (struct abis_om_fom_hdr *) msg->l3h;
@@ -1440,6 +1455,14 @@
return -EIO;
}
+ if (msgb_l3len(msg) < oh->length) {
+ oml_tx_failure_event_rep(&bts->mo, OSMO_EVT_MAJ_UKWN_MSG,
+ "Short OML message: %u < %u\n",
+ msgb_l3len(msg), oh->length);
+ msgb_free(msg);
+ return -EIO;
+ }
+
switch (oh->mdisc) {
case ABIS_OM_MDISC_FOM:
if (msgb_l2len(msg) < sizeof(*oh)) {
--
To view, visit https://gerrit.osmocom.org/12873
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: Ib98f0d7c2cff9172714ed18667c02564540d65d7
Gerrit-Change-Number: 12873
Gerrit-PatchSet: 3
Gerrit-Owner: Harald Welte <[email protected]>
Gerrit-Reviewer: Harald Welte <[email protected]>
Gerrit-Reviewer: Jenkins Builder (1000002)
Gerrit-Reviewer: Max <[email protected]>
Gerrit-Reviewer: Pau Espin Pedrol <[email protected]>
