sysmocom
/
open5gs
forked from acouzens/open5gs
11
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[GTP-U] Fixed a stack overflow bug (#3003)

This commit is contained in:
Sukchan Lee 2024-02-23 19:55:58 +00:00
parent 41d8934677
commit 9a515e9b1d
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/gtp/util.c
View File

@ -65,7 +65,8 @@ int ogs_gtpu_parse_header(
* then the value of the Next Extension Header Type shall be 0. */
i = 0;
while (*(ext_h = (((uint8_t *)gtp_h) + len - 1))) {
while (*(ext_h = (((uint8_t *)gtp_h) + len - 1)) &&
i < OGS_GTP2_NUM_OF_EXTENSION_HEADER) {
/*
* The length of the Extension header shall be defined
* in a variable length of 4 octets, i.e. m+1 = n*4 octets,
@ -125,6 +126,11 @@ int ogs_gtpu_parse_header(
i++;
}
if (i >= OGS_GTP2_NUM_OF_EXTENSION_HEADER) {
ogs_error("The number of extension headers is limited to [%d]", i);
return -1;
}
} else if (gtp_h->flags & (OGS_GTPU_FLAGS_S|OGS_GTPU_FLAGS_PN)) {
/*
* If and only if one or more of these three flags are set,