Osmocom Open Build Service

osmo-bsc.spec Changed

commit_797378af74e899eec6fd87102ca104bc7da3a722.txt Added

commit_9573ccbe2b04b37cd857841d26c578b037eb77cb.txt Deleted

osmo-bsc_1.9.0.47.9573c.dsc -> osmo-bsc_1.9.0.48.79737.dsc Changed

@@ -2,7 +2,7 @@
 Source: osmo-bsc
 Binary: osmo-bsc, osmo-bsc-dbg, abisip-find, osmo-bsc-ipaccess-utils, osmo-bsc-bs11-utils, osmo-bsc-meas-utils, osmo-bsc-doc
 Architecture: any all
-Version: 1.9.0.47.9573c
+Version: 1.9.0.48.79737
 Maintainer: Osmocom team <openbsc@lists.osmocom.org>
 Homepage: https://projects.osmocom.org/projects/osmo-bsc
 Standards-Version: 3.9.8
@@ -18,8 +18,8 @@
  osmo-bsc-ipaccess-utils deb net extra arch=any
  osmo-bsc-meas-utils deb net extra arch=any
 Checksums-Sha1:
- 1d8de0ff4103050f164805dbc9e8295907a9ec6e 580044 osmo-bsc_1.9.0.47.9573c.tar.xz
+ cfa0f0b1af97b279f9774e38aa9813174f05d92a 580256 osmo-bsc_1.9.0.48.79737.tar.xz
 Checksums-Sha256:
- c2fe9b89ad26105868048c561c7fc0e21227a49956edcf8bf5506fc496fb126b 580044 osmo-bsc_1.9.0.47.9573c.tar.xz
+ 9c913e68c33a7f291e2d9e67e50dbbcaec0f04c2a5cc2f777cf842f48d7b0a59 580256 osmo-bsc_1.9.0.48.79737.tar.xz
 Files:
- 5469ce49269bf15e7e63517327b72574 580044 osmo-bsc_1.9.0.47.9573c.tar.xz
+ 8883c8577dcf907f1032899cf5027f26 580256 osmo-bsc_1.9.0.48.79737.tar.xz

osmo-bsc_1.9.0.47.9573c.tar.xz/.tarball-version -> osmo-bsc_1.9.0.48.79737.tar.xz/.tarball-version Changed

osmo-bsc_1.9.0.47.9573c.tar.xz/debian/changelog -> osmo-bsc_1.9.0.48.79737.tar.xz/debian/changelog Changed

osmo-bsc_1.9.0.47.9573c.tar.xz/include/osmocom/bsc/pcu_if.h -> osmo-bsc_1.9.0.48.79737.tar.xz/include/osmocom/bsc/pcu_if.h Changed

osmo-bsc_1.9.0.47.9573c.tar.xz/src/osmo-bsc/pcu_sock.c -> osmo-bsc_1.9.0.48.79737.tar.xz/src/osmo-bsc/pcu_sock.c Changed

@@ -448,8 +448,17 @@
 	return rc;
 }
 
+#define CHECK_IF_MSG_SIZE(prim_len, prim_msg) \
+	do { \
+		size_t _len = PCUIF_HDR_SIZE + sizeof(prim_msg); \
+		if (prim_len < _len) { \
+			LOGP(DPCU, LOGL_ERROR, "Received %zu bytes on PCU Socket, but primitive %s " \
+			     "size is %zu, discarding\n", prim_len, #prim_msg, _len); \
+			return -EINVAL; \
+		} \
+	} while (0)
 static int pcu_rx(struct gsm_network *net, uint8_t msg_type,
-	struct gsm_pcu_if *pcu_prim)
+	struct gsm_pcu_if *pcu_prim, size_t prim_len)
 {
 	int rc = 0;
 	struct gsm_bts *bts;
@@ -460,6 +469,7 @@
 	switch (msg_type) {
 	case PCU_IF_MSG_DATA_REQ:
 	case PCU_IF_MSG_PAG_REQ:
+		CHECK_IF_MSG_SIZE(prim_len, pcu_prim->u.data_req);
 		rc = pcu_rx_data_req(bts, msg_type, &pcu_prim->u.data_req);
 		break;
 	default:
@@ -574,7 +584,14 @@
 		goto close;
 	}
 
-	rc = pcu_rx(state->net, pcu_prim->msg_type, pcu_prim);
+	if (rc < PCUIF_HDR_SIZE) {
+		LOGP(DPCU, LOGL_ERROR, "Received %d bytes on PCU Socket, but primitive hdr size "
+		     "is %zu, discarding\n", rc, PCUIF_HDR_SIZE);
+		msgb_free(msg);
+		return 0;
+	}
+
+	rc = pcu_rx(state->net, pcu_prim->msg_type, pcu_prim, rc);
 
 	/* as we always synchronously process the message in pcu_rx() and
 	 * its callbacks, we can free the message here. */

Changes of Revision 2