laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43410?usp=email )
Change subject: mtp3_rtpc: Fix potential assert getting rcxt_ie->len < 4 ...................................................................... mtp3_rtpc: Fix potential assert getting rcxt_ie->len < 4 If an incoming message which contains an unbounded Routing Context IE, it may be that it comes malformed and hence len is < 4. In that case, xua_msg_part_get_u32() would have hit an ASSERT. Fix the problem by simply passing by the whole Routing Context (removing non-multiple of 4 potential churn at the end), since anyway we should be sending the same whole set of Routing Contexts we received. Related: OS#7074 Reported-By: Tristan Madani <[email protected]> Change-Id: Ia0a8dd4907d6ad786e9cc257d299a1521dd45dee --- M src/mtp3_rtpc.c 1 file changed, 4 insertions(+), 4 deletions(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/mtp3_rtpc.c b/src/mtp3_rtpc.c index 34d40e7..a1a8856 100644 --- a/src/mtp3_rtpc.c +++ b/src/mtp3_rtpc.c @@ -42,14 +42,14 @@ struct xua_msg *xua; struct xua_msg_part *rctx_ie; unsigned int num_rctx = 0; - uint32_t rctx = 0; + uint32_t *rctx_raw = NULL; uint32_t aff_pc = htonl(orig_xua->mtp.dpc); if ((rctx_ie = xua_msg_find_tag(orig_xua, M3UA_IEI_ROUTE_CTX))) { - rctx = xua_msg_part_get_u32(rctx_ie); - num_rctx = 1; + rctx_raw = (uint32_t *) rctx_ie->dat; + num_rctx = rctx_ie->len / sizeof(uint32_t); } - xua = m3ua_encode_duna(&rctx, num_rctx, &aff_pc, 1, + xua = m3ua_encode_duna(rctx_raw, num_rctx, &aff_pc, 1, "transfer prohibited (inaccessible SP)"); OSMO_ASSERT(xua); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43410?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ia0a8dd4907d6ad786e9cc257d299a1521dd45dee Gerrit-Change-Number: 43410 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <[email protected]> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <[email protected]> Gerrit-Reviewer: osmith <[email protected]>
