From 29220a60dcf0334d1571f6473e63bebf131a419a Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Mon, 11 Nov 2024 10:51:57 +0100 Subject: [PATCH] Add check on minimum length in encode_5gs_mobile_identity --- openair3/NAS/COMMON/IES/FGSMobileIdentity.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/openair3/NAS/COMMON/IES/FGSMobileIdentity.c b/openair3/NAS/COMMON/IES/FGSMobileIdentity.c index c0b60f101f..bd98cc090a 100644 --- a/openair3/NAS/COMMON/IES/FGSMobileIdentity.c +++ b/openair3/NAS/COMMON/IES/FGSMobileIdentity.c @@ -37,6 +37,8 @@ #include "TLVDecoder.h" #include "FGSMobileIdentity.h" +#define MIN_LEN_FGS_MOBILE_ID_IE 3 // type of identity "No identity" + static int decode_guti_5gs_mobile_identity(Guti5GSMobileIdentity_t *guti, const uint8_t *buffer); static int encode_guti_5gs_mobile_identity(Guti5GSMobileIdentity_t *guti, uint8_t *buffer); @@ -77,6 +79,10 @@ int decode_5gs_mobile_identity(FGSMobileIdentity *fgsmobileidentity, uint8_t iei int encode_5gs_mobile_identity(FGSMobileIdentity *fgsmobileidentity, uint8_t iei, uint8_t *buffer, uint32_t len) { + // Return if buffer is shorter than min length + if (len < MIN_LEN_FGS_MOBILE_ID_IE) + return -1; + int encoded_rc = TLV_ENCODE_VALUE_DOESNT_MATCH; uint32_t encoded = 0; @@ -86,6 +92,7 @@ int encode_5gs_mobile_identity(FGSMobileIdentity *fgsmobileidentity, uint8_t iei } encoded = encoded + 2; + len -= encoded; if (fgsmobileidentity->guti.typeofidentity == FGS_MOBILE_IDENTITY_5G_GUTI) { encoded_rc = encode_guti_5gs_mobile_identity(&fgsmobileidentity->guti,