maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PSEA - IEI DNN - protect code from a bad DNN length received from the network

Browse Source
This commit is contained in:
Angelo Athanassopoulos
2022-10-28 13:24:25 +02:00
parent 8e4ebb078a
commit 43f3d03ddb
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c
+7 -3
View File
@@ -169,10 +169,14 @@ void capture_pdu_session_establishment_accept_msg(uint8_t *buffer, uint32_t msg_
psea_msg.dnn_ie.dnn_length = *(buffer + offset++); psea_msg.dnn_ie.dnn_length = *(buffer + offset++);
char apn[APN_MAX_LEN]; char apn[APN_MAX_LEN];
for (int i = 0 ; i < psea_msg.dnn_ie.dnn_length ; ++i) if(psea_msg.dnn_ie.dnn_length <= APN_MAX_LEN &&
apn[i] = *(buffer + offset + i); psea_msg.dnn_ie.dnn_length >= APN_MIN_LEN) {
for (int i = 0 ; i < psea_msg.dnn_ie.dnn_length ; ++i)
apn[i] = *(buffer + offset + i);
LOG_T(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - APN: %s\n", apn);
} else
LOG_E(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - DNN IE has invalid length\n");
LOG_T(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - APN: %s\n", apn);
offset += psea_msg.dnn_ie.dnn_length; offset += psea_msg.dnn_ie.dnn_length;
psea_iei = *(buffer + offset++); psea_iei = *(buffer + offset++);
break; break;