Compare commits

..

2 Commits

Author SHA1 Message Date
Oliver Smith
7d236cca56 Generate a version.h file
Related: OS#6626
Change-Id: I8460e85d50149f4bc58b6048e5596c5768010829
2025-06-23 16:48:06 +02:00
Pau Espin Pedrol
2fdedc0715 mgw: osmux: Fix heap-use-after-free
As found by Asan on a osmo-mgw running in production:
"""
 ==2238035==ERROR: AddressSanitizer: heap-use-after-free on address 0x62100043bdca at pc 0x7f9bcebaa070 bp 0x7ffcb08f2150 sp 0x7ffcb08f2148
 READ of size 2 at 0x62100043bdca thread T0
     #0 0x7f9bcebaa06f in msgb_length src/core/msgb.c:287
     #1 0x55869457a8ff in conn_osmux_send_rtp src/libosmo-mgcp/mgcp_osmux.c:245
     #2 0x558694563a86 in mgcp_dispatch_rtp_bridge_cb src/libosmo-mgcp/mgcp_network.c:1347
     #3 0x5586945570a9 in rx_rtp src/libosmo-mgcp/mgcp_network.c:1550
     #4 0x5586945570a9 in rtp_recvfrom_cb src/libosmo-mgcp/mgcp_network.c:1505
     #5 0x7f9bcebc96cc in iofd_poll_ofd_cb_recvmsg_sendmsg src/core/osmo_io_poll.c:84
     #6 0x7f9bcebcb699 in iofd_poll_ofd_cb_dispatch src/core/osmo_io_poll.c:136
     #7 0x7f9bcebd7df5 in poll_disp_fds src/core/select.c:419
     #8 0x7f9bcebd7df5 in _osmo_select_main src/core/select.c:457
     #9 0x7f9bcebd8298 in osmo_select_main src/core/select.c:496
     #10 0x558694534f2e in main src/osmo-mgw/mgw_main.c:428
"""

Related: SYS#7450
Change-Id: Id90c77aaf44422c3ed70ffb06560537e920a468c
2025-04-25 13:48:46 +02:00
4 changed files with 39 additions and 2 deletions

1
.gitignore vendored
View File

@@ -9,6 +9,7 @@ Makefile.in
bscconfig.h
bscconfig.h.in
include/osmocom/mgcp_client/mgcp_common.h
include/osmocom/mgcp_client/version.h
src/osmo-mgw/osmo-mgw
*.*~
*.sw?

View File

@@ -1,5 +1,6 @@
BUILT_SOURCES = \
mgcp_common.h \
version.h \
$(NULL)
noinst_HEADERS = \
@@ -11,4 +12,20 @@ mgcp_common.h: $(top_srcdir)/include/osmocom/mgcp/mgcp_common.h
echo -e "/*\n\n DO NOT EDIT THIS FILE!\n THIS IS OVERWRITTEN DURING BUILD\n This is an automatic copy of <osmocom/mgcp/mgcp_common.h>\n\n */" > mgcp_common.h
cat $(top_srcdir)/include/osmocom/mgcp/mgcp_common.h >> mgcp_common.h
CLEANFILES = mgcp_common.h
version.h: version.h.tpl
$(AM_V_GEN)$(MKDIR_P) $(dir $@)
$(AM_V_GEN)sed \
-e "s/{{VERSION}}/$$(echo '@VERSION@' | cut -d. -f1-3)/g" \
-e "s/{{VERSION_MAJOR}}/$$(echo '@VERSION@' | cut -d. -f1)/g" \
-e "s/{{VERSION_MINOR}}/$$(echo '@VERSION@' | cut -d. -f2)/g" \
-e "s/{{VERSION_PATCH}}/$$(echo '@VERSION@' | cut -d. -f3)/g" \
$< > $@
EXTRA_DIST = \
version.h.tpl \
$(NULL)
CLEANFILES = \
mgcp_common.h \
version.h \
$(NULL)

View File

@@ -0,0 +1,16 @@
#pragma once
#define LIBOSMO_MGCP_CLIENT_VERSION {{VERSION}}
#define LIBOSMO_MGCP_CLIENT_VERSION_STR "{{VERSION}}"
#define LIBOSMO_MGCP_CLIENT_VERSION_MAJOR {{VERSION_MAJOR}}
#define LIBOSMO_MGCP_CLIENT_VERSION_MINOR {{VERSION_MINOR}}
#define LIBOSMO_MGCP_CLIENT_VERSION_PATCH {{VERSION_PATCH}}
#define LIBOSMO_MGCP_CLIENT_VERSION_GREATER_EQUAL(major, minor, patch) \
(LIBOSMO_MGCP_CLIENT_VERSION_MAJOR > (major) || \
(LIBOSMO_MGCP_CLIENT_VERSION_MAJOR == (major) && \
LIBOSMO_MGCP_CLIENT_VERSION_MINOR > (minor)) || \
(LIBOSMO_MGCP_CLIENT_VERSION_MAJOR == (major) && \
LIBOSMO_MGCP_CLIENT_VERSION_MINOR == (minor) && \
LIBOSMO_MGCP_CLIENT_VERSION_PATCH >= (patch)))

View File

@@ -211,6 +211,7 @@ osmux_handle_find_or_create(const struct mgcp_trunk *trunk, const struct osmo_so
int conn_osmux_send_rtp(struct mgcp_conn_rtp *conn, struct msgb *msg)
{
int ret;
size_t msg_len;
if (!conn->end.output_enabled) {
rtpconn_osmux_rate_ctr_inc(conn, OSMUX_RTP_PACKETS_TX_DROPPED_CTR);
@@ -234,15 +235,17 @@ int conn_osmux_send_rtp(struct mgcp_conn_rtp *conn, struct msgb *msg)
return -1;
}
msg_len = msgb_length(msg);
while ((ret = osmux_xfrm_input(conn->osmux.in, msg, conn->osmux.remote_cid)) > 0) {
/* batch full, build and deliver it */
osmux_xfrm_input_deliver(conn->osmux.in);
}
/* NOTE: At this point msg is now owned by osmux subsystem and may have been potentially freed. */
if (ret < 0) {
rtpconn_osmux_rate_ctr_inc(conn, OSMUX_RTP_PACKETS_TX_DROPPED_CTR);
} else {
rtpconn_osmux_rate_ctr_inc(conn, OSMUX_RTP_PACKETS_TX_CTR);
rtpconn_osmux_rate_ctr_add(conn, OSMUX_AMR_OCTETS_TX_CTR, msgb_length(msg) - sizeof(struct rtp_hdr));
rtpconn_osmux_rate_ctr_add(conn, OSMUX_AMR_OCTETS_TX_CTR, msg_len - sizeof(struct rtp_hdr));
}
return 0;
}