Change in libosmocore[master]: gsm48_mi_to_string(): guard against zero length output buffer
Harald Welte has submitted this change and it was merged. (
https://gerrit.osmocom.org/12156 )
Change subject: gsm48_mi_to_string(): guard against zero length output buffer
..
gsm48_mi_to_string(): guard against zero length output buffer
All successful cases already return from the switch(), so simply handle all
errors below it by returning an empty string (if there is enough string
buffer).
Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571
---
M src/gsm/gsm48.c
M tests/gsm0408/gsm0408_test.ok
2 files changed, 13 insertions(+), 13 deletions(-)
Approvals:
Harald Welte: Looks good to me, approved
Pau Espin Pedrol: Looks good to me, approved
Stefan Sperling: Looks good to me, but someone else must approve
Jenkins Builder: Verified
diff --git a/src/gsm/gsm48.c b/src/gsm/gsm48.c
index 0f0889b..af3e14c 100644
--- a/src/gsm/gsm48.c
+++ b/src/gsm/gsm48.c
@@ -653,14 +653,11 @@
{
int rc;
uint8_t mi_type;
- char *str_cur = string;
uint32_t tmsi;
mi_type = mi[0] & GSM_MI_TYPE_MASK;
switch (mi_type) {
- case GSM_MI_TYPE_NONE:
- break;
case GSM_MI_TYPE_TMSI:
/* Table 10.5.4.3, reverse generate_mid_from_tmsi */
if (mi_len == GSM48_TMSI_LEN && mi[0] == (0xf0 |
GSM_MI_TYPE_TMSI)) {
@@ -680,12 +677,15 @@
return rc + 1;
else
return strlen(string) + 1;
+
default:
break;
}
- *str_cur++ = '\0';
- return str_cur - string;
+ if (str_len < 1)
+ return 0;
+ *string = '\0';
+ return 1;
}
/*! Parse TS 04.08 Routing Area Identifier
diff --git a/tests/gsm0408/gsm0408_test.ok b/tests/gsm0408/gsm0408_test.ok
index 6e99f5b..d6579e5 100644
--- a/tests/gsm0408/gsm0408_test.ok
+++ b/tests/gsm0408/gsm0408_test.ok
@@ -72,8 +72,8 @@
returned empty string
- MI type: TMSI
- writing to zero-length string:
-rc=1
-ERROR: Wrote to invalid memory!
+rc=0
+nothing written
- writing to 1-byte-length string:
rc=1
returned empty string
@@ -82,8 +82,8 @@
returned empty string
- MI type: NONE
- writing to zero-length string:
-rc=1
-ERROR: Wrote to invalid memory!
+rc=0
+nothing written
- writing to 1-byte-length string:
rc=1
returned empty string
@@ -102,8 +102,8 @@
returned empty string
- MI type: TMSI | GSM_MI_ODD
- writing to zero-length string:
-rc=1
-ERROR: Wrote to invalid memory!
+rc=0
+nothing written
- writing to 1-byte-length string:
rc=1
returned empty string
@@ -112,8 +112,8 @@
returned empty string
- MI type: NONE | GSM_MI_ODD
- writing to zero-length string:
-rc=1
-ERROR: Wrote to invalid memory!
+rc=0
+nothing written
- writing to 1-byte-length string:
rc=1
returned empty string
--
To view, visit https://gerrit.osmocom.org/12156
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571
Gerrit-Change-Number: 12156
Gerrit-PatchSet: 8
Gerrit-Owner: Neels Hofmeyr
Gerrit-Reviewer: Harald Welte
Gerrit-Reviewer: Jenkins Builder (102)
Gerrit-Reviewer: Pau Espin Pedrol
Gerrit-Reviewer: Stefan Sperling
Change in libosmocore[master]: gsm48_mi_to_string(): guard against zero length output buffer
Harald Welte has posted comments on this change. ( https://gerrit.osmocom.org/12156 ) Change subject: gsm48_mi_to_string(): guard against zero length output buffer .. Patch Set 7: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/12156 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571 Gerrit-Change-Number: 12156 Gerrit-PatchSet: 7 Gerrit-Owner: Neels Hofmeyr Gerrit-Reviewer: Harald Welte Gerrit-Reviewer: Jenkins Builder (102) Gerrit-Reviewer: Pau Espin Pedrol Gerrit-Reviewer: Stefan Sperling Gerrit-Comment-Date: Mon, 10 Dec 2018 17:06:11 + Gerrit-HasComments: No Gerrit-HasLabels: Yes
Change in libosmocore[master]: gsm48_mi_to_string(): guard against zero length output buffer
Stefan Sperling has posted comments on this change. ( https://gerrit.osmocom.org/12156 ) Change subject: gsm48_mi_to_string(): guard against zero length output buffer .. Patch Set 5: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/12156 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571 Gerrit-Change-Number: 12156 Gerrit-PatchSet: 5 Gerrit-Owner: Neels Hofmeyr Gerrit-Reviewer: Jenkins Builder (102) Gerrit-Reviewer: Pau Espin Pedrol Gerrit-Reviewer: Stefan Sperling Gerrit-Comment-Date: Thu, 06 Dec 2018 18:14:50 + Gerrit-HasComments: No Gerrit-HasLabels: Yes
Change in libosmocore[master]: gsm48_mi_to_string(): guard against zero length output buffer
Pau Espin Pedrol has posted comments on this change. ( https://gerrit.osmocom.org/12156 ) Change subject: gsm48_mi_to_string(): guard against zero length output buffer .. Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/12156 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571 Gerrit-Change-Number: 12156 Gerrit-PatchSet: 3 Gerrit-Owner: Neels Hofmeyr Gerrit-Reviewer: Jenkins Builder (102) Gerrit-Reviewer: Pau Espin Pedrol Gerrit-Comment-Date: Thu, 06 Dec 2018 12:26:23 + Gerrit-HasComments: No Gerrit-HasLabels: Yes
Change in libosmocore[master]: gsm48_mi_to_string(): guard against zero length output buffer
Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/12156 to look at the new patch set (#3). Change subject: gsm48_mi_to_string(): guard against zero length output buffer .. gsm48_mi_to_string(): guard against zero length output buffer All successful cases already return from the switch(), so simply handle all errors below it by returning an empty string (if there is enough string buffer). Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571 --- M src/gsm/gsm48.c M tests/gsm0408/gsm0408_test.ok 2 files changed, 13 insertions(+), 13 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/56/12156/3 -- To view, visit https://gerrit.osmocom.org/12156 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571 Gerrit-Change-Number: 12156 Gerrit-PatchSet: 3 Gerrit-Owner: Neels Hofmeyr Gerrit-Reviewer: Jenkins Builder (102)
Change in libosmocore[master]: gsm48_mi_to_string(): guard against zero length output buffer
Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/12156 to look at the new patch set (#2). Change subject: gsm48_mi_to_string(): guard against zero length output buffer .. gsm48_mi_to_string(): guard against zero length output buffer All successful cases already return from the switch(), so simply handle all errors below it by returning an empty string (if there is enough string buffer). Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571 --- M src/gsm/gsm48.c M tests/gsm0408/gsm0408_test.ok 2 files changed, 13 insertions(+), 13 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/56/12156/2 -- To view, visit https://gerrit.osmocom.org/12156 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571 Gerrit-Change-Number: 12156 Gerrit-PatchSet: 2 Gerrit-Owner: Neels Hofmeyr Gerrit-Reviewer: Jenkins Builder (102)
Change in libosmocore[master]: gsm48_mi_to_string(): guard against zero length output buffer
Neels Hofmeyr has uploaded this change for review. (
https://gerrit.osmocom.org/12156
Change subject: gsm48_mi_to_string(): guard against zero length output buffer
..
gsm48_mi_to_string(): guard against zero length output buffer
All successful cases already return from the switch(), so simply handle all
errors below it by returning an empty string (if there is enough string
buffer).
Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571
---
M src/gsm/gsm48.c
M tests/gsm0408/gsm0408_test.ok
2 files changed, 13 insertions(+), 12 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/56/12156/1
diff --git a/src/gsm/gsm48.c b/src/gsm/gsm48.c
index 3487ef7..7517c09 100644
--- a/src/gsm/gsm48.c
+++ b/src/gsm/gsm48.c
@@ -658,8 +658,6 @@
mi_type = mi[0] & GSM_MI_TYPE_MASK;
switch (mi_type) {
- case GSM_MI_TYPE_NONE:
- break;
case GSM_MI_TYPE_TMSI:
/* Table 10.5.4.3, reverse generate_mid_from_tmsi */
if (mi_len == GSM48_TMSI_LEN && mi[0] == (0xf0 |
GSM_MI_TYPE_TMSI)) {
@@ -679,12 +677,15 @@
return 0;
else
return strlen(string) + 1;
+
default:
break;
}
- *str_cur++ = '\0';
- return str_cur - string;
+ if (str_len < 1)
+ return 0;
+ *string = '\0';
+ return 1;
}
/*! Parse TS 04.08 Routing Area Identifier
diff --git a/tests/gsm0408/gsm0408_test.ok b/tests/gsm0408/gsm0408_test.ok
index 6e99f5b..d6579e5 100644
--- a/tests/gsm0408/gsm0408_test.ok
+++ b/tests/gsm0408/gsm0408_test.ok
@@ -72,8 +72,8 @@
returned empty string
- MI type: TMSI
- writing to zero-length string:
-rc=1
-ERROR: Wrote to invalid memory!
+rc=0
+nothing written
- writing to 1-byte-length string:
rc=1
returned empty string
@@ -82,8 +82,8 @@
returned empty string
- MI type: NONE
- writing to zero-length string:
-rc=1
-ERROR: Wrote to invalid memory!
+rc=0
+nothing written
- writing to 1-byte-length string:
rc=1
returned empty string
@@ -102,8 +102,8 @@
returned empty string
- MI type: TMSI | GSM_MI_ODD
- writing to zero-length string:
-rc=1
-ERROR: Wrote to invalid memory!
+rc=0
+nothing written
- writing to 1-byte-length string:
rc=1
returned empty string
@@ -112,8 +112,8 @@
returned empty string
- MI type: NONE | GSM_MI_ODD
- writing to zero-length string:
-rc=1
-ERROR: Wrote to invalid memory!
+rc=0
+nothing written
- writing to 1-byte-length string:
rc=1
returned empty string
--
To view, visit https://gerrit.osmocom.org/12156
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I709ac3b9efb7b4258d8660715b10312e11b9b571
Gerrit-Change-Number: 12156
Gerrit-PatchSet: 1
Gerrit-Owner: Neels Hofmeyr
