From 5dd9ead820615b64aa15f911e5fa41dae79f1aa6 Mon Sep 17 00:00:00 2001 From: Eduard Vlad Date: Thu, 22 May 2025 15:10:40 +0200 Subject: [PATCH] DL NAS Transport: Fix Message Type retrieval on too short message The change addresses the SM message type retrieval for DL NAS Transport messages. The assumption of an offset 17 = 7 (MM Sec) + 3 (MM Plain) + 1 (IEI) + 2 (Len) + 4 (SM) is correct. However, if the DL NAS Transport is received in a plain header, the lengths would not add up anymore. (This is not complying with the standard, so not allowed, but possible). The check for the length is necessary to not process arbitrary memory contents beyond the `pdu_buffer`. Signed-off-by: Eduard Vlad --- openair3/NAS/NR_UE/nr_nas_msg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/openair3/NAS/NR_UE/nr_nas_msg.c b/openair3/NAS/NR_UE/nr_nas_msg.c index b1378c3360..74e5498663 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg.c +++ b/openair3/NAS/NR_UE/nr_nas_msg.c @@ -1202,6 +1202,10 @@ static void handle_pdu_session_accept(uint8_t *pdu_buffer, uint32_t msg_length, */ void handleDownlinkNASTransport(uint8_t * pdu_buffer, int pdu_length, int instance) { + if (pdu_length < 17) { + LOG_E(NAS, "Received DL NAS Transport message too short (%d)\n", pdu_length); + return; + } uint8_t msg_type = *(pdu_buffer + 16); if (msg_type == FGS_PDU_SESSION_ESTABLISHMENT_ACC) { LOG_A(NAS, "Received PDU Session Establishment Accept in DL NAS Transport\n");