Re: SMPP SMS-MO broken

Hi Andreas

...
> 2002-10-21 09:14:04 [6] DEBUG: sm_length: 0 = 0x00000000
> 2002-10-21 09:14:04 [6] DEBUG: short_message: ""

not directly, but we have something that is close to it, I'll try to
explain:

We have seen sometimes that our bearerox throw a panic and restarted
in a safe box shell chain.

It seems that following happens: A MO SMS arrives, but the sm_length
indicator does not match the actual length of the short_message text.

Now, see gw/smsc/smpp_pdu.c:191:

  #define OCTETS(name, field_giving_octets) \
    	p->name = octstr_copy(data_without_len, pos, \
	    	    	      p->field_giving_octets); \
    	gw_assert(p->field_giving_octets == \
	    	  (unsigned long) octstr_len(p->name)); \
	pos += p->field_giving_octets;
 
this is where our panic (assert check failure) came from. The SMPP pdu
unpacking routine requires that the sm_length is exactly the length of
the short_message text block, which is spec conform.

Your Octstr dump:

2002-10-21 09:14:04 [6] DEBUG: data: 01 00 00 00 00 04 24 00 ......$. 
2002-10-21 09:14:04 [6] DEBUG: data: 04 54 45 53 54 .TEST 
2002-10-21 09:14:04 [6] DEBUG: Octet string dump ends.  

hmm, sm_length is 04 here, so should be ok.

We don't see this effect to often, but we changed our unpacking
routine in that way that it does not drop assertion panic and better
throws an error with an dump and ignores the message.

Stipe

[email protected]
-------------------------------------------------------------------
Wapme Systems AG

Vogelsanger Weg 80
40470 Düsseldorf

Tel: +49-211-74845-0
Fax: +49-211-74845-299

E-Mail: [email protected]
Internet: http://www.wapme-systems.de
-------------------------------------------------------------------
wapme.net - wherever you are