From 3e27e53f5267b68f12318d3bbdc2df2136a5550b Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Thu, 28 Nov 2024 11:31:35 +0100 Subject: [PATCH] Handle size in nas_protected_security_header_encode --- openair3/NAS/NR_UE/5GS/fgs_nas_lib.c | 9 ++++++--- openair3/NAS/NR_UE/nr_nas_msg.c | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/openair3/NAS/NR_UE/5GS/fgs_nas_lib.c b/openair3/NAS/NR_UE/5GS/fgs_nas_lib.c index 723306b6bc..f27380739c 100644 --- a/openair3/NAS/NR_UE/5GS/fgs_nas_lib.c +++ b/openair3/NAS/NR_UE/5GS/fgs_nas_lib.c @@ -115,10 +115,13 @@ int mm_msg_encode(const fgmm_nas_message_plain_t *p, uint8_t *buffer, uint32_t l int nas_protected_security_header_encode(uint8_t *buffer, const fgs_nas_message_security_header_t *header, int length) { - LOG_FUNC_IN; - int size = 0; + if (length < sizeof(fgs_nas_message_security_header_t)) { + PRINT_NAS_ERROR("Could not encode the NAS security header\n"); + return -1; + } + /* Encode the protocol discriminator) */ ENCODE_U8(buffer, header->protocol_discriminator, size); @@ -130,7 +133,7 @@ int nas_protected_security_header_encode(uint8_t *buffer, const fgs_nas_message_ /* Encode the sequence number */ ENCODE_U8(buffer + size, header->sequence_number, size); - LOG_FUNC_RETURN(size); + return size; } /** diff --git a/openair3/NAS/NR_UE/nr_nas_msg.c b/openair3/NAS/NR_UE/nr_nas_msg.c index 129e06e70f..658ac1fab3 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg.c +++ b/openair3/NAS/NR_UE/nr_nas_msg.c @@ -667,7 +667,7 @@ static void generateSecurityModeComplete(nr_ue_nas_t *nas, as_nas_info_t *initia // encode the message initialNasMsg->nas_data = malloc_or_fail(size * sizeof(*initialNasMsg->nas_data)); - int security_header_len = nas_protected_security_header_encode(initialNasMsg->nas_data, &nas_msg.header, size); + int security_header_len = nas_protected_security_header_encode(initialNasMsg->nas_data, sp, size); initialNasMsg->length = security_header_len