From 673770d34627263d898b7438c08d5c6de8ecfee4 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Wed, 19 Feb 2025 12:47:34 +0100 Subject: [PATCH] Bugfix in e1_decode_pdu_session_to_mod_item: missing check on allocation of optional pointer The Bearer Context Modification Request test is adding 1 QoS Flow, therefore the encoding/decoding is done and this bug does not show. The issue is there when no QoS Flow is mapped in the DRBnGRanModList, therefore when no memory is allocated for the optional IE, and the member is accessed in the decoding of the Flow Mapping Information. --- openair2/E1AP/lib/e1ap_bearer_context_management.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/openair2/E1AP/lib/e1ap_bearer_context_management.c b/openair2/E1AP/lib/e1ap_bearer_context_management.c index 42065c53f2..6035258e95 100644 --- a/openair2/E1AP/lib/e1ap_bearer_context_management.c +++ b/openair2/E1AP/lib/e1ap_bearer_context_management.c @@ -1350,10 +1350,12 @@ static bool e1_decode_pdu_session_to_mod_item(pdu_session_to_mod_t *out, const E } } // QoS Flows Information To Be Setup (O) - E1AP_QoS_Flow_QoS_Parameter_List_t *qos2SetupList = drb2Mod->flow_Mapping_Information; - drb->numQosFlow2Setup = qos2SetupList->list.count; - for (int k = 0; k < qos2SetupList->list.count; k++) { - CHECK_E1AP_DEC(e1_decode_qos_flow_to_setup(drb->qosFlows + k, qos2SetupList->list.array[k])); + if (drb2Mod->flow_Mapping_Information) { + E1AP_QoS_Flow_QoS_Parameter_List_t *qos2SetupList = drb2Mod->flow_Mapping_Information; + drb->numQosFlow2Setup = qos2SetupList->list.count; + for (int k = 0; k < qos2SetupList->list.count; k++) { + CHECK_E1AP_DEC(e1_decode_qos_flow_to_setup(drb->qosFlows + k, qos2SetupList->list.array[k])); + } } } return true;