maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent pulling TLV tag and length over end of the buffer.

Browse Source 
Checks whether there are at least 4 bytes available to pull tag and length values.
On tlv_list unpack, if the size is sent as 0, immediately exit the function
This commit is contained in:
Rúben Soares Silva
2025-07-11 10:01:26 +01:00
parent 1026b8121f
commit 43c733dc89
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nfapi/open-nFAPI/common/src/nfapi.c
+2 -2
View File
@@ -889,8 +889,8 @@ int unpack_nr_tlv_list(unpack_tlv_t unpack_fns[],
nfapi_tl_t generic_tl; nfapi_tl_t generic_tl;
uint8_t numBadTags = 0; uint8_t numBadTags = 0;
uint16_t idx = 0; uint16_t idx = 0;
if (size == 0) { return 1; }
while ((uint8_t *)(*ppReadPackedMsg) < end) { while ((uint8_t *)(*ppReadPackedMsg) + 4 < end) {
// unpack the tl and process the values accordingly // unpack the tl and process the values accordingly
if (unpack_tl(ppReadPackedMsg, &generic_tl, end) == 0) if (unpack_tl(ppReadPackedMsg, &generic_tl, end) == 0)
return 0; return 0;
nfapi/open-nFAPI/fapi/src/nr_fapi_p5.c
+1 -1
View File
@@ -1347,7 +1347,7 @@ uint8_t unpack_nr_config_request(uint8_t **ppReadPackedMsg, uint8_t *end, void *
nfapi_tl_t generic_tl; nfapi_tl_t generic_tl;
uint8_t numBadTags = 0; uint8_t numBadTags = 0;
unsigned long idx = 0; unsigned long idx = 0;
while ((uint8_t *)(*ppReadPackedMsg) < end) { while ((uint8_t *)(*ppReadPackedMsg) + 4 < end) {
// unpack the tl and process the values accordingly // unpack the tl and process the values accordingly
if (unpack_tl(ppReadPackedMsg, &generic_tl, end) == 0) if (unpack_tl(ppReadPackedMsg, &generic_tl, end) == 0)
return 0; return 0;