[PATCH] osmo-msc[master]: libmsc: bssap: Catch TLV parse failures

[Pau Espin Pedrol]

Review at  https://gerrit.osmocom.org/6451

libmsc: bssap: Catch TLV parse failures

Change-Id: I1d1951f4a5daf200e85c76fea14a35e952491d27
---
M src/libmsc/a_iface_bssap.c
1 file changed, 7 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/51/6451/1

diff --git a/src/libmsc/a_iface_bssap.c b/src/libmsc/a_iface_bssap.c
index 1adbe69..2947d85 100644
--- a/src/libmsc/a_iface_bssap.c
+++ b/src/libmsc/a_iface_bssap.c
@@ -522,13 +522,19 @@
 {
struct gsm_subscriber_connection *conn;
struct tlv_parsed tp;
+   int rc;
 
if (msgb_l3len(msg) < 1) {
LOGP(DBSSAP, LOGL_NOTICE, "Error: No data received -- 
discarding message!\n");
return -1;
}
 
-   tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) - 1, 
0, 0);
+   rc = tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) 
- 1, 0, 0);
+   if (rc < 0) {
+   LOGP(DBSSAP, LOGL_ERROR, "Failed parsing TLV -- discarding 
message! %s\n",
+   osmo_hexdump(msg->l3h, msgb_l3len(msg)));
+   return -EINVAL;
+   }
 
/* Only message types allowed without a 'conn' */
switch (msg->l3h[0]) {

-- 
To view, visit https://gerrit.osmocom.org/6451
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I1d1951f4a5daf200e85c76fea14a35e952491d27
Gerrit-PatchSet: 1
Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-Owner: Pau Espin Pedrol 

[PATCH] osmo-msc[master]: libmsc: bssap: Catch TLV parse failures

[Pau Espin Pedrol]

Review at  https://gerrit.osmocom.org/6448

libmsc: bssap: Catch TLV parse failures

Change-Id: I6aef9a94fa5b2e0b62a9c1744b8e18e5985f788f
---
M src/libmsc/a_iface_bssap.c
1 file changed, 49 insertions(+), 9 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/48/6448/1

diff --git a/src/libmsc/a_iface_bssap.c b/src/libmsc/a_iface_bssap.c
index 0946a5d..e0cbf03 100644
--- a/src/libmsc/a_iface_bssap.c
+++ b/src/libmsc/a_iface_bssap.c
@@ -224,6 +224,10 @@
LOGPCONN(conn, LOGL_INFO, "Rx BSSMAP CLEAR REQUEST\n");
 
tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) - 1, 
0, 0);
+   if (rc < 0) {
+   LOGP(DBSSAP, LOGL_ERROR, "Failed parsing TLV -- discarding 
message!\n");
+   return -EINVAL;
+   }
if (!TLVP_PRESENT(&tp, GSM0808_IE_CAUSE)) {
LOGP(DBSSAP, LOGL_ERROR, "Cause code is missing -- discarding 
message!\n");
return -EINVAL;
@@ -276,7 +280,11 @@
 
LOGP(DBSSAP, LOGL_INFO, "Rx BSSMAP COMPLETE L3 INFO (conn_id=%i)\n", 
a_conn_info->conn_id);
 
-   tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) - 1, 
0, 0);
+   rc = tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) 
- 1, 0, 0);
+   if (rc < 0) {
+   LOGP(DBSSAP, LOGL_ERROR, "Failed parsing TLV -- discarding 
message!\n");
+   return -EINVAL;
+   }
if (!TLVP_PRESENT(&tp, GSM0808_IE_CELL_IDENTIFIER)) {
LOGP(DBSSAP, LOGL_ERROR, "Mandatory CELL IDENTIFIER not present 
-- discarding message!\n");
return -EINVAL;
@@ -339,10 +347,15 @@
const uint8_t *cm3 = NULL;
uint8_t cm2_len = 0;
uint8_t cm3_len = 0;
+   int rc;
 
LOGPCONN(conn, LOGL_DEBUG, "Rx BSSMAP CLASSMARK UPDATE\n");
 
-   tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) - 1, 
0, 0);
+   rc = tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) 
- 1, 0, 0);
+   if (rc < 0) {
+   LOGP(DBSSAP, LOGL_ERROR, "Failed parsing TLV -- discarding 
message!\n");
+   return -EINVAL;
+   }
if (!TLVP_PRESENT(&tp, GSM0808_IE_CLASSMARK_INFORMATION_T2)) {
LOGPCONN(conn, LOGL_ERROR, "Mandatory Classmark Information 
Type 2 not present -- discarding message!\n");
return -EINVAL;
@@ -374,10 +387,15 @@
 
struct tlv_parsed tp;
uint8_t alg_id = 1;
+   int rc;
 
LOGPCONN(conn, LOGL_DEBUG, "Rx BSSMAP CIPHER MODE COMPLETE\n");
 
-   tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) - 1, 
0, 0);
+   rc = tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) 
- 1, 0, 0);
+   if (rc < 0) {
+   LOGP(DBSSAP, LOGL_ERROR, "Failed parsing TLV -- discarding 
message!\n");
+   return -EINVAL;
+   }
 
if (TLVP_PRESENT(&tp, GSM0808_IE_CHOSEN_ENCR_ALG)) {
alg_id = TLVP_VAL(&tp, GSM0808_IE_CHOSEN_ENCR_ALG)[0] - 1;
@@ -401,10 +419,15 @@
 {
struct tlv_parsed tp;
uint8_t cause;
+   int rc;
 
LOGPCONN(conn, LOGL_NOTICE, "RX BSSMAP CIPHER MODE REJECT\n");
 
-   tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) - 1, 
0, 0);
+   rc = tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) 
- 1, 0, 0);
+   if (rc < 0) {
+   LOGP(DBSSAP, LOGL_ERROR, "Failed parsing TLV -- discarding 
message!\n");
+   return -EINVAL;
+   }
if (!TLVP_PRESENT(&tp, BSS_MAP_MSG_CIPHER_MODE_REJECT)) {
LOGPCONN(conn, LOGL_ERROR, "Cause code is missing -- discarding 
message!\n");
return -EINVAL;
@@ -426,10 +449,15 @@
uint8_t cause;
uint8_t *rr_cause_ptr = NULL;
uint8_t rr_cause;
+   int rc;
 
LOGPCONN(conn, LOGL_NOTICE, "Rx BSSMAP ASSIGNMENT FAILURE message\n");
 
-   tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) - 1, 
0, 0);
+   rc = tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) 
- 1, 0, 0);
+   if (rc < 0) {
+   LOGP(DBSSAP, LOGL_ERROR, "Failed parsing TLV -- discarding 
message!\n");
+   return -EINVAL;
+   }
if (!TLVP_PRESENT(&tp, GSM0808_IE_CAUSE)) {
LOGPCONN(conn, LOGL_ERROR, "Cause code is missing -- discarding 
message!\n");
return -EINVAL;
@@ -458,19 +486,28 @@
 {
struct tlv_parsed tp;
uint8_t dlci;
+   int rc;
 
LOGPCONN(conn, LOGL_NOTICE, "Rx BSSMAP SAPI-N-REJECT message\n");
 
/* Note: The MSC code seems not to care about the cause code, but by
 * the specification it is mandatory, so we check its presence. See
 * also 3GPP TS 48.008 3.2.1.34 SAPI "n" REJECT */
-   tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1, msgb_l3len(msg) - 1, 
0, 0);
+   rc = tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l3h + 1,