Project

General

Profile

Actions

Bug #3806

open

OsmoBSC accepts BSSAP with wrong length field

Added by laforge about 5 years ago. Updated over 3 years ago.

Status:
Stalled
Priority:
Normal
Assignee:
-
Category:
A interface
Target version:
-
Start date:
02/18/2019
Due date:
% Done:

40%

Spec Reference:

Description

As seen in #3805, OsmoBSC would happily accept BSSMAP CLEAR COMMAND messages with IEs that extend beyond the length field of the BSSAP header.

This is definitely wrong. We should

  • parse the length field
  • ensure we have a minimum of that number of bytes of payload as specified by the length field
  • truncate the msgb to a payload length as specified

This way any additional garbage at the end of a message would simply be ignored, with us only parsing the specified "length" number of bytes.

Let's also make sure to add TTCN-3 tests for this, intentionally sending length field values too large and too short.

Once implemented in OsmoBSC, we should also implement it on the MSC side.


Files

bssap_adapter.diff bssap_adapter.diff 774 Bytes laforge, 03/26/2019 10:11 AM

Related issues

Related to OsmoMSC - Bug #3805: OsmoMSC sends invalid BSSMAP length field on CSFB CLEAR COMMANDResolvedlaforge02/18/2019

Actions
Actions

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)