mirror of
https://github.com/open5gs/open5gs.git
synced 2026-04-26 10:30:41 +00:00
5ab76f2bea
The HTTP upload handling in access_handler() used ogs_malloc() and ogs_realloc() results directly assigned to request->http.content and checked with ogs_assert(). On allocation failure this could abort the process, leading to a potential denial-of-service condition. The pattern was similar to the issue previously fixed in on_data_chunk_recv() (CVE-2022-3299). This change introduces a temporary pointer for memory allocation and updates request->http.content only after successful allocation. It also adds overflow-safe length checks before resizing the buffer and removes assert-based error handling in favor of graceful failure. This prevents process termination on allocation failure and aligns the memory handling logic with the hardened implementation used in nghttp2-based handlers. Issues: #4387 |
||
|---|---|---|
| .. | ||
| app | ||
| asn1c | ||
| core | ||
| crypt | ||
| dbi | ||
| diameter | ||
| gtp | ||
| ipfw | ||
| metrics | ||
| nas | ||
| ngap | ||
| pfcp | ||
| proto | ||
| s1ap | ||
| sbi | ||
| sctp | ||
| tun | ||
| meson.build | ||