sysmocom
/
open5gs
forked from acouzens/open5gs
11
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[GTP-U] Fixed a stack overflow bug (#3003)

This commit is contained in:
Sukchan Lee 2024-02-23 19:55:58 +00:00
parent 41d8934677
commit 9a515e9b1d
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/gtp/util.c
View File

@ -65,7 +65,8 @@ int ogs_gtpu_parse_header(
* then the value of the Next Extension Header Type shall be 0. */ * then the value of the Next Extension Header Type shall be 0. */
i = 0; i = 0;
while (*(ext_h = (((uint8_t *)gtp_h) + len - 1))) { while (*(ext_h = (((uint8_t *)gtp_h) + len - 1)) &&
i < OGS_GTP2_NUM_OF_EXTENSION_HEADER) {
/* /*
* The length of the Extension header shall be defined * The length of the Extension header shall be defined
* in a variable length of 4 octets, i.e. m+1 = n*4 octets, * in a variable length of 4 octets, i.e. m+1 = n*4 octets,
@ -125,6 +126,11 @@ int ogs_gtpu_parse_header(
i++; i++;
} }
if (i >= OGS_GTP2_NUM_OF_EXTENSION_HEADER) {
ogs_error("The number of extension headers is limited to [%d]", i);
return -1;
}
} else if (gtp_h->flags & (OGS_GTPU_FLAGS_S|OGS_GTPU_FLAGS_PN)) { } else if (gtp_h->flags & (OGS_GTPU_FLAGS_S|OGS_GTPU_FLAGS_PN)) {
/* /*
* If and only if one or more of these three flags are set, * If and only if one or more of these three flags are set,