maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle empty RRC ULInformationTransfer

Browse Source 
A UE might send a ULInformationTransfer without the actual content present
(intentionally or not). Check this and handle appropriately to avoid
a segfault when reading the empty NAS message.

Closes: #862
This commit is contained in:
Robert Schmidt
2024-10-17 19:06:45 +02:00
parent 304372d5e6
commit 132cd64bb0
1 changed files with 20 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair2/RRC/NR/rrc_gNB_NGAP.c
+20 -14
View File
@@ -652,21 +652,27 @@ int rrc_gNB_process_NGAP_DOWNLINK_NAS(MessageDef *msg_p, instance_t instance, mu
void rrc_gNB_send_NGAP_UPLINK_NAS(gNB_RRC_INST *rrc, gNB_RRC_UE_t *UE, const NR_UL_DCCH_Message_t *const ul_dcch_msg) void rrc_gNB_send_NGAP_UPLINK_NAS(gNB_RRC_INST *rrc, gNB_RRC_UE_t *UE, const NR_UL_DCCH_Message_t *const ul_dcch_msg)
{ {
MessageDef *msg_p; NR_ULInformationTransfer_t *ulInformationTransfer = ul_dcch_msg->message.choice.c1->choice.ulInformationTransfer;
NR_ULInformationTransfer_t *ulInformationTransfer = ul_dcch_msg->message.choice.c1->choice.ulInformationTransfer;
if (ulInformationTransfer->criticalExtensions.present == NR_ULInformationTransfer__criticalExtensions_PR_ulInformationTransfer) { NR_ULInformationTransfer__criticalExtensions_PR p = ulInformationTransfer->criticalExtensions.present;
NR_DedicatedNAS_Message_t *nas = ulInformationTransfer->criticalExtensions.choice.ulInformationTransfer->dedicatedNAS_Message; if (p != NR_ULInformationTransfer__criticalExtensions_PR_ulInformationTransfer) {
uint8_t *buf = malloc(nas->size); LOG_E(NR_RRC, "UE %d: expected presence of ulInformationTransfer, but message has %d\n", UE->rrc_ue_id, p);
AssertFatal(buf != NULL, "out of memory\n"); return;
memcpy(buf, nas->buf, nas->size); }
msg_p = itti_alloc_new_message (TASK_RRC_GNB, rrc->module_id, NGAP_UPLINK_NAS);
NGAP_UPLINK_NAS(msg_p).gNB_ue_ngap_id = UE->rrc_ue_id; NR_DedicatedNAS_Message_t *nas = ulInformationTransfer->criticalExtensions.choice.ulInformationTransfer->dedicatedNAS_Message;
NGAP_UPLINK_NAS (msg_p).nas_pdu.length = nas->size; if (!nas) {
NGAP_UPLINK_NAS (msg_p).nas_pdu.buffer = buf; LOG_E(NR_RRC, "UE %d: expected NAS message in ulInformation, but it is NULL\n", UE->rrc_ue_id);
itti_send_msg_to_task(TASK_NGAP, rrc->module_id, msg_p); return;
LOG_D(NR_RRC,"Send RRC GNB UL Information Transfer \n"); }
}
uint8_t *buf = malloc_or_fail(nas->size);
memcpy(buf, nas->buf, nas->size);
MessageDef *msg_p = itti_alloc_new_message(TASK_RRC_GNB, rrc->module_id, NGAP_UPLINK_NAS);
NGAP_UPLINK_NAS(msg_p).gNB_ue_ngap_id = UE->rrc_ue_id;
NGAP_UPLINK_NAS(msg_p).nas_pdu.length = nas->size;
NGAP_UPLINK_NAS(msg_p).nas_pdu.buffer = buf;
itti_send_msg_to_task(TASK_NGAP, rrc->module_id, msg_p);
} }
void rrc_gNB_send_NGAP_PDUSESSION_SETUP_RESP(gNB_RRC_INST *rrc, gNB_RRC_UE_t *UE, uint8_t xid) void rrc_gNB_send_NGAP_PDUSESSION_SETUP_RESP(gNB_RRC_INST *rrc, gNB_RRC_UE_t *UE, uint8_t xid)