Merge remote-tracking branch 'origin/dl-nas-transport-len-check' into integration_2025_w25 (!3446)

DL NAS Transport: Fix Message Type retrieval on too short message

The change addresses the SM message type retrieval for DL NAS Transport
messages. The assumption of an offset 17 = 7 (MM Sec) + 3 (MM Plain) + 1
(IEI) + 2 (Len) + 4 (SM) is correct.

However, if the DL NAS Transport is received in a plain header, the
lengths would not add up anymore. (This is not complying with the
standard, so not allowed, but possible). The check for the length is
necessary to not process arbitrary memory contents beyond the
pdu_buffer.

openair3/NAS/NR_UE/nr_nas_msg.c

@@ -1495,6 +1495,10 @@ static void handle_pdu_session_accept(uint8_t *pdu_buffer, uint32_t msg_length,
  */
 void handleDownlinkNASTransport(uint8_t * pdu_buffer, int pdu_length, int instance)
 {
+  if (pdu_length < 17) {
+    LOG_E(NAS, "Received DL NAS Transport message too short (%d)\n", pdu_length);
+    return;
+  }
   uint8_t msg_type = *(pdu_buffer + 16);
   if (msg_type == FGS_PDU_SESSION_ESTABLISHMENT_ACC) {
     LOG_A(NAS, "Received PDU Session Establishment Accept in DL NAS Transport\n");