mirror of
https://github.com/open5gs/open5gs.git
synced 2026-08-22 06:43:55 +00:00
76d2237c0e
Some checks are pending
Meson Continuous Integration / Build and Test on Ubuntu Latest (push) Waiting to run
ogs_fqdn_parse() returns -EINVAL on invalid FQDN encoding, but the DNN and APN decoders stored the result directly into the uint8_t length field. The negative value was truncated (-22 -> 234), so the "if (length > 0)" guard passed and ogs_cpystrn() copied up to 101 bytes from an uninitialized stack buffer that ogs_fqdn_parse() never wrote. The guard was written when ogs_fqdn_parse() returned 0 on failure; the later switch to -EINVAL broke it via the unsigned truncation. Capture the return value in a signed int, take the error branch on negative/zero, and assign to length only on success. Applied to both ogs_nas_5gs_decode_dnn and ogs_nas_eps_decode_access_point_name via the support/type-list.py templates; generated ies.c regenerated. Found by OSS-Fuzz (nas_5gs_message_fuzz, MSan). Issues: #4645 |
||
|---|---|---|
| .. | ||
| 5gs | ||
| common | ||
| eps | ||
| meson.build | ||