From a1c4c356bd7f3febc3454ea80d121d41fbbb41fd Mon Sep 17 00:00:00 2001 From: Cedric Roux Date: Fri, 24 May 2024 23:12:08 +0200 Subject: [PATCH] nrUE NAS: check NAS COUNT UL It should not be > 0xffffff. Normally the core network would prevent this case from happening. Plus to reach this value means to send a lot of NAS messages, which is very doubtful in practice. Anyway, it's better to deal with the case. We exit if that happens. To be refined if needed (very doubtful). --- openair3/NAS/NR_UE/nr_nas_msg_sim.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/openair3/NAS/NR_UE/nr_nas_msg_sim.c b/openair3/NAS/NR_UE/nr_nas_msg_sim.c index 2594bbad92..05feaafac2 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg_sim.c +++ b/openair3/NAS/NR_UE/nr_nas_msg_sim.c @@ -668,6 +668,7 @@ static void generateSecurityModeComplete(nr_ue_nas_t *nas, as_nas_info_t *initia /* ciphering */ uint8_t buf[initialNasMsg->length - 7]; stream_cipher.context = nas->security_container->ciphering_context; + AssertFatal(nas->security.nas_count_ul <= 0xffffff, "fatal: NAS COUNT UL too big (todo: fix that)\n"); stream_cipher.count = nas->security.nas_count_ul; stream_cipher.bearer = 1; stream_cipher.direction = 0; @@ -814,6 +815,7 @@ static void generateRegistrationComplete(nr_ue_nas_t *nas, as_nas_info_t *initia /* ciphering */ uint8_t buf[initialNasMsg->length - 7]; stream_cipher.context = nas->security_container->ciphering_context; + AssertFatal(nas->security.nas_count_ul <= 0xffffff, "fatal: NAS COUNT UL too big (todo: fix that)\n"); stream_cipher.count = nas->security.nas_count_ul; stream_cipher.bearer = 1; stream_cipher.direction = 0; @@ -888,6 +890,7 @@ static void generateDeregistrationRequest(nr_ue_nas_t *nas, as_nas_info_t *initi /* ciphering */ uint8_t buf[initialNasMsg->length - 7]; stream_cipher.context = nas->security_container->ciphering_context; + AssertFatal(nas->security.nas_count_ul <= 0xffffff, "fatal: NAS COUNT UL too big (todo: fix that)\n"); stream_cipher.count = nas->security.nas_count_ul; stream_cipher.bearer = 1; stream_cipher.direction = 0; @@ -993,6 +996,7 @@ static void generatePduSessionEstablishRequest(nr_ue_nas_t *nas, as_nas_info_t * /* ciphering */ uint8_t buf[initialNasMsg->length - 7]; stream_cipher.context = nas->security_container->ciphering_context; + AssertFatal(nas->security.nas_count_ul <= 0xffffff, "fatal: NAS COUNT UL too big (todo: fix that)\n"); stream_cipher.count = nas->security.nas_count_ul; stream_cipher.bearer = 1; stream_cipher.direction = 0;