OML: Properly reject short messages and truncate over-long messages

For OML, what matters is the length indicated in the OML message header.

If we don't have sufficient bytes, reject the message and send a failure
event report.

If we have more bytes, truncate the message at the number of bytes
indicated in the OML length header.

Change-Id: Ib98f0d7c2cff9172714ed18667c02564540d65d7

1 files changed, 23 insertions, 0 deletions

diff --git a/src/common/oml.c b/src/common/oml.c
index d389e298..8bc31f85 100644
--- a/src/common/oml.c
+++ b/src/common/oml.c
@@ -1087,6 +1087,7 @@ static inline bool report_bts_number_incorrect(struct gsm_bts *bts, const struct
 
 static int down_fom(struct gsm_bts *bts, struct msgb *msg)
 {
+	struct abis_om_hdr *oh = msgb_l2(msg);
 	struct abis_om_fom_hdr *foh = msgb_l3(msg);
 	struct gsm_bts_trx *trx;
 	const struct gsm_abis_mo *mo = &bts->mo;
@@ -1100,6 +1101,13 @@ static int down_fom(struct gsm_bts *bts, struct msgb *msg)
 		return -EIO;
 	}
 
+	if (msgb_l3len(msg) > oh->length) {
+		LOGP(DOML, LOGL_NOTICE, "OML message with %u extraneous bytes at end: %s\n",
+			msgb_l3len(msg) - oh->length, msgb_hexdump(msg));
+		/* remove extra bytes at end */
+		msgb_l3trim(msg, oh->length);
+	}
+
 	if (report_bts_number_incorrect(bts, foh, true))
 		return oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN);
 
@@ -1383,6 +1391,13 @@ static int down_mom(struct gsm_bts *bts, struct msgb *msg)
 		return -EINVAL;
 	}
 
+	if (msgb_l3len(msg) > oh->length + 1 + oh->data[0]) {
+		LOGP(DOML, LOGL_NOTICE, "OML message with %u extraneous bytes at end: %s\n",
+			msgb_l3len(msg) - oh->length, msgb_hexdump(msg));
+		/* remove extra bytes at end */
+		msgb_l3trim(msg, oh->length);
+	}
+
 	msg->l3h = oh->data + 1 + idstrlen;
 	foh = (struct abis_om_fom_hdr *) msg->l3h;
 
@@ -1440,6 +1455,14 @@ int down_oml(struct gsm_bts *bts, struct msgb *msg)
 		return -EIO;
 	}
 
+	if (msgb_l3len(msg) < oh->length) {
+		oml_tx_failure_event_rep(&bts->mo, OSMO_EVT_MAJ_UKWN_MSG,
+					 "Short OML message: %u < %u\n",
+					 msgb_l3len(msg), oh->length);
+		msgb_free(msg);
+		return -EIO;
+	}
+
 	switch (oh->mdisc) {
 	case ABIS_OM_MDISC_FOM:
 		if (msgb_l2len(msg) < sizeof(*oh)) {