forked from acouzens/open5gs
[GTPU] Fixed Stack-Buffer-Overflow in GTPU (#2609)
This commit is contained in:
parent
bfe8ae659e
commit
aa746794e7
|
@ -76,6 +76,12 @@ int ogs_gtpu_parse_header(
|
||||||
ogs_error("No length in the Extension header");
|
ogs_error("No length in the Extension header");
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (((*ext_h) * 4) > OGS_GTP2_MAX_EXTENSION_HEADER_LEN) {
|
||||||
|
ogs_error("Overflow length : %d", (*ext_h));
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
if (pkbuf->len < len) {
|
if (pkbuf->len < len) {
|
||||||
ogs_error("the length of the packet is insufficient[%d:%d]",
|
ogs_error("the length of the packet is insufficient[%d:%d]",
|
||||||
pkbuf->len, len);
|
pkbuf->len, len);
|
||||||
|
|
|
@ -73,6 +73,10 @@ typedef struct ogs_gtp2_extension_header_s {
|
||||||
uint16_t udp_port;
|
uint16_t udp_port;
|
||||||
uint16_t pdcp_number;
|
uint16_t pdcp_number;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
/* sizeof(extension_header.array[i]) */
|
||||||
|
#define OGS_GTP2_MAX_EXTENSION_HEADER_LEN 4
|
||||||
|
|
||||||
#define OGS_GTP2_NUM_OF_EXTENSION_HEADER 8
|
#define OGS_GTP2_NUM_OF_EXTENSION_HEADER 8
|
||||||
} __attribute__ ((packed)) array[OGS_GTP2_NUM_OF_EXTENSION_HEADER];
|
} __attribute__ ((packed)) array[OGS_GTP2_NUM_OF_EXTENSION_HEADER];
|
||||||
} __attribute__ ((packed)) ogs_gtp2_extension_header_t;
|
} __attribute__ ((packed)) ogs_gtp2_extension_header_t;
|
||||||
|
|
Loading…
Reference in New Issue