After reading data from the socket, assigned to a given VTY, we
need to '\0'-terminate the received string. Otherwise, further
access to that string, stored in a heap buffer vty->buf, would
lead to a heap overrun.
== How to reproduce?
$ python -c "print 'A' * 512" | telnet $HOST $PORT
==21264==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x6190000211e0 at pc 0x000000435d2f
bp 0x7ffc06c7add0 sp 0x7ffc06c7a578
READ of size 1025 at 0x6190000211e0 thread T0
#0 0x435d2e in __interceptor_strlen (/usr/local/bin/osmo-msc+0x435d2e)
#1 0x7fb95bfa5624 in talloc_strdup (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x6624)
#2 0x7fb95c1be2bc in vty_hist_add /opt/osmocom/libosmocore/src/vty/vty.c:578
#3 0x7fb95c1be2bc in vty_execute /opt/osmocom/libosmocore/src/vty/vty.c:703
#4 0x7fb95c1be2bc in vty_read /opt/osmocom/libosmocore/src/vty/vty.c:1425
#5 0x7fb95c1bfd78 in client_data /opt/osmocom/libosmocore/src/vty/telnet_interface.c:157
#6 0x7fb95b90bd33 in osmo_fd_disp_fds /opt/osmocom/libosmocore/src/select.c:223
#7 0x7fb95b90bd33 in osmo_select_main /opt/osmocom/libosmocore/src/select.c:263
#8 0x5006cc in main /opt/osmocom/osmo-msc/src/osmo-msc/msc_main.c:723:3
#9 0x7fb959935f44 in __libc_start_main /build/eglibc-xkFqqE/eglibc-2.19/csu/libc-start.c:287
#10 0x4226fb in _start (/usr/local/bin/osmo-msc+0x4226fb)
== Why exactly 512?
Because the initial size of the heap buffer is 512 (see VTY_BUFSIZ).
Later on it can be realloc()ated, so X > 512 should also work.
Found using AddressSanitizer and Radamsa [1] fuzzer.
[1] https://gitlab.com/akihe/radamsa
Change-Id: I82f774ad18d0e555eb8f3590a519946d9c583c78
Unfortunately, osmo_sock_get_name_buf() fails in telnet_close_client():
DLGLOBAL INFO telnet_interface.c:130 Closing telnet connection <error-in-getsockname>
because getsockname(), getpeername(), and even close() fail with:
"Bad file descriptor".
This looks like a bug of the existing code.
Change-Id: I77b31abfa159d2f269deaa5a08d94b7bbba7d23c
After recent system upgrade, gcc 9.1.0, I started getting gsm0808_test
failing locally:
Assert failed memcmp(&enc_ct, &dec_ct, sizeof(enc_ct)) == 0 libosmocore/tests/gsm0808/gsm0808_test.c:992
During investigation with gdb, fields of both structures seem to contain
same values. However, closer lookup gives some hints on why it fails:
(gdb) print memcmp(&enc_ct, &dec_ct, sizeof(enc_ct))
$1 = 85
(gdb) print memcmp(&enc_ct, &dec_ct, 12)
$14 = 85
(gdb) print ((uint8_t*)&enc_ct)[11]
$15 = 85 'U'
(gdb) print ((uint8_t*)&dec_ct)[11]
$16 = 0 '\000'
So the 12th byte in struct gsm0808_channel_type is basically an
alignment padding byte added by the compiler (to align perm_spch_len to
4-byte alignment). Since both compared structs are initialized without
memset(0) but using compiler's designated initializers, it seems the compiler
decided it's no longer needed to zero the padding byte, making memcp fail in
this case.
In order to avoid the failure, let's properly check every field instead
of using memcp here.
Change-Id: I17fe7a0a5dc650f050bba1f47d071be749550729
Unconditional initialization follows the structure definition,
so there is no need to do it twice. This prevents compiler
from warning about potential errors.
Change-Id: If9fd2826f132dfa203dda62940d93dbdfcfd92ac
ubsan will report undefined behavior due to the SUN_LEN macros interaction with a null pointer,
so let's tell ubsan to ignore this function. After carefully reviewing the final publically
availlable drafts of the C99,C11 and C18 standards I can confirm that dereferencing null pointers
is still undefined behavior, as such ubsan will always warn with absolutely every existing compiler
version. Since the sanitizers are periodically synced between llvm and gcc I'm also fairly confident
that rebuilding everything with compiler_rt to use the integrated sanitizers would result in the same message.
I sincerly hope that this explanation provides to be sufficient, If not I'd be willing to show up at
the next llvm dev meeting to provide quotes from actual sanitizer developers to back up these claims.
Change-Id: I0ff445072f1b46390c9f70b21d61c789e39358d5
Rather than having the encoder/decoder library print some log
messages in case of encoding/decoding errors, let's provide something
akin to 'errno', but with a string instead of a numeric error code.
The 'osmo_cbsp_errstr' global variable (if set) contains a
human-readable string describing the most recent encoding/decoding error.
It exists separately for each thread and hence can be used safely in
multi-threaded environments.
Change-Id: Id9a5a595a76ba278647aee9470ded213d8464103
This introduces definitions as well as a parser+encoder for the
Cell Broadcast Service Protocol (CBSP) as specified in 3GPP TS 48.049.
CBSP is used on the interface between CBC and BSC.
Related: OS#3537
Change-Id: I5b7ae08f67e415967b60ac4b824db9e22ca00935
The link quality, defined by C/I (Carrier-to-Interference) ratio,
can be computed from the training sequence of each burst, where we
can compare the "ideal" training sequence with the actual training
sequence and then express that in cB (centiBels, dB * 10).
By analogy with both RSSI and ToA, it can be used to filter out
false-positive detections and ghost Access Bursts.
Change-Id: Ie2a66ebd040b61d6daf49e04bf8a84d3d64764ee
This reverts commit 4e284b6379.
Unfortunately, some projects such as OsmoMSC, OsmoBTS and OpenBSC
do contain OSMO_ASSERT statements without a semi colon. Thus,
this change causes compilation errors when building them.
Please note that only the OSMO_ASSERT's definition is reverted,
while changes to other files (adding missing semicolons) are kept.
Change-Id: I6da4d7397d993f6c1af658cb5ae1e49c92a1b350
When using `OSMO_ASSERT(exp);` clang will warn about
an empty expression because the semi colon was superflous.
Use do {} while (0) to enfore the need of a semi colon.
This might break other test.
Change-Id: I2272d29a81496164bebd1696a694383a28a86434
Do not remove the entire doc/vty/ dir during the doxygen generation,
because it contains versioned files.
Fixes: 2fe50ac951 ("doxygen: enable cross referencing everywhere")
Related: OS#3986
Change-Id: I884398c5e834ae2fac0af8c9b52d65bb3ceacb2d
Ignore files created during the two-pass doxygen generation that was
introduced in Ib03d0b70d536c8f1386def666c89106a840f7363.
Change-Id: I719bbc968420c462426d2c0ce703c7f3b2c1139e
The timeout is calculated dynamically in t200_by_lchan() based on FN
advance value estimated by bts_get_avg_fn_advance(), so it's informative
to have the final value printed out.
Change-Id: Ib50a9c23de881c66c9218833703cc41101e06bfd
This reverts commit b3f94eb39e, that
unfortunately breaks some projects which call osmo_fsm_register()
on DSO load (i.e. using __attribute__((constructor))) before the
logging is initialized.
Change-Id: Idc6fcce7e946c23d48589b920e309d60aa7b6645
As suggested by Vadim while reviewing a related fix for ipa_keepalive.c
in libosmo-abis (see https://gerrit.osmocom.org/#/c/libosmo-abis/+/13540/),
it makes sense to print an error message if anyone registers a FSM
that specifies an allstate_action callback but at the same time no
events that would ever end up in that callback.
Change-Id: I9e73f7363ab15a00843e3f0d1e5776f4be7ebc46
For instance, take command "single0 [one]":
If user executes "single0 on", VTY func will receive argv[0]="one"
instead of argv[0]="on".
Related: OS#4045
Change-Id: I5f4e2d16c62a2d22717989c6acc77450957168cb
For instance, take command "multi0 (one|two|three)":
If user executes "multi0 tw", VTY func will receive argv[0]="two"
instead of argv[0]="tw".
Fixes: OS#4045
Change-Id: I91b6621ac3d87fda5412a9b415e7bfb4736c8a9a
The test shows that in the case were "single0 on" is executed, VTY
function should return complete "single0 one" but it doesn't.
Related: OS#4045
Change-Id: Ib5b9dc07e2b280dc95011b3926afb1d490cadd81
Check against MAX argc is changed to == since it cannot be incremented
twice without passing the check.
Change-Id: Ia330e475989fda863bedcc3cbf94deaf8dd83037
It was noticed that multithreaded processes like osmo-trx can crash upon
using ctime().
Related: OS#4055
Change-Id: I19ebf29a2f1fc855bb7d56766b338c7c3432dfd1
the DEBUG macro name and ARRAY_SIZE macro function are frequently
used in other projects. If these projects also use libosmocore,
the macros will be redefined. This also generates a warning message
during compilation.
Not redefining the macros removes the warning message and possible
(but unlikely) mis-redefinition.
Change-Id: I0ba91eae8eacc5542d1647601b372e417ed1713c
Huge conditional block inside for loop is negated in this patch
together with a "continue" keyword, similar to what was already done
recently in 4742526645.
Change-Id: I803c4ed38e9ab09bf929528c75a60e6f65da3928
inner block defined variable "enum match_type ret" was being masking
outter block variable "int ret = 0". The ret variable was being given
non zero values only inside the inner block, so that change was done on
the inner variable and not the outer one, which is returned.
Fixes: 5314c513f2
Change-Id: Iec87d7db49a096d07e38ff8a060b923a52bfd6ba
Huge conditional block inside foor loop is negated in this patch
together with a "continue" keyword.
Change-Id: I9715734ed276f002fdc8c3b9742531ad36b2ef9e
Vadim Yanitskiy
Pau Espin
Daniel Willmann
Eric Wild
Harald Welte
Oliver Smith
Kevin Redon