From 906357c5e2292d776968af4e364ee1e657d2c117 Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Sat, 9 Feb 2019 21:59:51 +0100 Subject: OML: Properly reject short messages and truncate over-long messages For OML, what matters is the length indicated in the OML message header. If we don't have sufficient bytes, reject the message and send a failure event report. If we have more bytes, truncate the message at the number of bytes indicated in the OML length header. Change-Id: Ib98f0d7c2cff9172714ed18667c02564540d65d7 --- src/common/oml.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/src/common/oml.c b/src/common/oml.c index d389e298..8bc31f85 100644 --- a/src/common/oml.c +++ b/src/common/oml.c @@ -1087,6 +1087,7 @@ static inline bool report_bts_number_incorrect(struct gsm_bts *bts, const struct static int down_fom(struct gsm_bts *bts, struct msgb *msg) { + struct abis_om_hdr *oh = msgb_l2(msg); struct abis_om_fom_hdr *foh = msgb_l3(msg); struct gsm_bts_trx *trx; const struct gsm_abis_mo *mo = &bts->mo; @@ -1100,6 +1101,13 @@ static int down_fom(struct gsm_bts *bts, struct msgb *msg) return -EIO; } + if (msgb_l3len(msg) > oh->length) { + LOGP(DOML, LOGL_NOTICE, "OML message with %u extraneous bytes at end: %s\n", + msgb_l3len(msg) - oh->length, msgb_hexdump(msg)); + /* remove extra bytes at end */ + msgb_l3trim(msg, oh->length); + } + if (report_bts_number_incorrect(bts, foh, true)) return oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN); @@ -1383,6 +1391,13 @@ static int down_mom(struct gsm_bts *bts, struct msgb *msg) return -EINVAL; } + if (msgb_l3len(msg) > oh->length + 1 + oh->data[0]) { + LOGP(DOML, LOGL_NOTICE, "OML message with %u extraneous bytes at end: %s\n", + msgb_l3len(msg) - oh->length, msgb_hexdump(msg)); + /* remove extra bytes at end */ + msgb_l3trim(msg, oh->length); + } + msg->l3h = oh->data + 1 + idstrlen; foh = (struct abis_om_fom_hdr *) msg->l3h; @@ -1440,6 +1455,14 @@ int down_oml(struct gsm_bts *bts, struct msgb *msg) return -EIO; } + if (msgb_l3len(msg) < oh->length) { + oml_tx_failure_event_rep(&bts->mo, OSMO_EVT_MAJ_UKWN_MSG, + "Short OML message: %u < %u\n", + msgb_l3len(msg), oh->length); + msgb_free(msg); + return -EIO; + } + switch (oh->mdisc) { case ABIS_OM_MDISC_FOM: if (msgb_l2len(msg) < sizeof(*oh)) { -- cgit v1.2.3