NAS Registration Reject: Add bounds and lengths checks

This change adds lengths checks to the received registration reject
message and also performs a bounds check for the received cause.
Since the cause is not checked, any string in the memory can be
dereferenced, possibly leading to DoS.

Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>

openair3/NAS/NR_UE/nr_nas_msg.c

@@ -32,6 +32,7 @@
 #include "nr_nas_msg.h"
 #include <netinet/in.h>
 #include "NR_NAS_defs.h"
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -1798,10 +1799,23 @@ void *nas_nrue(void *args_p)
           case FGS_PDU_SESSION_ESTABLISHMENT_REJ:
             LOG_E(NAS, "Received PDU Session Establishment reject\n");
             break;
-          case FGS_REGISTRATION_REJECT:
-            LOG_E(NAS, "Received Registration reject cause: %s\n", cause_text_info[pdu_buffer[17]].text);
+          case FGS_REGISTRATION_REJECT: {
+
+            if (pdu_length < 18) {
+              LOG_E(NAS, "Received Registration reject message too short\n");
+              break;
+            }
+
+            uint8_t cause = pdu_buffer[17];
+            if (cause >= sizeof(cause_text_info) / sizeof(cause_text_info[0])) {
+              LOG_E(NAS, "Received Registration reject cause %d unknown\n", cause);
+              break;
+            }
+
+            LOG_E(NAS, "Received Registration reject cause: %s\n", cause_text_info[cause].text);
             exit(1);
             break;
+          }
           case FGS_SERVICE_ACCEPT: {
             byte_array_t buffer = {.buf = pdu_buffer, .len = pdu_length};
             handle_service_accept(nas, &buffer);