vrr/open5gs
2
0
Fork 0
mirror of https://github.com/open5gs/open5gs.git synced 2026-04-28 03:19:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add wire length check before memcpy

Browse source
This commit is contained in:
iam-rishabh 2026-02-25 11:11:25 +05:30 • committed by Sukchan Lee
parent 09c286ba69
commit caaec827cf
1 changed files with 15 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/sgwc/s5c-handler.c
View file

@ -153,16 +153,23 @@ void sgwc_s5c_handle_create_session_response(
ogs_error("No PDN Address Allocation [Cause:%d]", session_cause);
cause_value = OGS_GTP2_CAUSE_CONDITIONAL_IE_MISSING;
} else {
memcpy(&sess->paa, rsp->pdn_address_allocation.data,
if(rsp->pdn_address_allocation.len > OGS_PAA_IPV4V6_LEN){
ogs_error("PAA IE Length (%u) exceeds maximum (%d)", "rejecting CreateSessionResponse",
rsp->pdn_address_allocation.len, OGS_PAA_IPV4V6_LEN);
cause_value = OGS_GTP2_CAUSE_MANDATORY_IE_INCORRECT;
} else{
memcpy(&sess->paa, rsp->pdn_address_allocation.data,
rsp->pdn_address_allocation.len);
sess->session.session_type = sess->paa.session_type;
if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
} else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
} else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
} else {
ogs_error("Unknown session-type [%d]", sess->session.session_type);
cause_value = OGS_GTP2_CAUSE_PREFERRED_PDN_TYPE_NOT_SUPPORTED;
sess->session.session_type = sess->paa.session_type;
if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4) {
} else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV6) {
} else if (sess->session.session_type == OGS_PDU_SESSION_TYPE_IPV4V6) {
} else {
ogs_error("Unknown session-type [%d]", sess->session.session_type);
cause_value = OGS_GTP2_CAUSE_PREFERRED_PDN_TYPE_NOT_SUPPORTED;
}
}
}
if (rsp->cause.presence == 0) {