[PFCP] buffer overflow in ALPINE (#1911, #2009)

A buffer overflow occurred in ALPINE
because the size of the pfcp message structure increased by

    ogs_pfcp_tlv_framed_route_t framed_route[8];
    ogs_pfcp_tlv_framed_ipv6_route_t framed_ipv6_route[8];

lib/pfcp/build.c

@@ -21,50 +21,78 @@
 
 ogs_pkbuf_t *ogs_pfcp_build_heartbeat_request(uint8_t type)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_heartbeat_request_t *req = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_debug("Heartbeat Request");
 
-    req = &pfcp_message.pfcp_heartbeat_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_heartbeat_request;
 
     req->recovery_time_stamp.presence = 1;
     req->recovery_time_stamp.u32 = ogs_pfcp_self()->pfcp_started;
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }
 
 ogs_pkbuf_t *ogs_pfcp_build_heartbeat_response(uint8_t type)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_heartbeat_response_t *rsp = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_debug("Heartbeat Response");
 
-    rsp = &pfcp_message.pfcp_heartbeat_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_heartbeat_response;
 
     rsp->recovery_time_stamp.presence = 1;
     rsp->recovery_time_stamp.u32 = ogs_pfcp_self()->pfcp_started;
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }
 
 ogs_pkbuf_t *ogs_pfcp_cp_build_association_setup_request(uint8_t type)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_association_setup_request_t *req = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_pfcp_node_id_t node_id;
     int node_id_len = 0, rv;
 
     ogs_debug("Association Setup Request");
 
-    req = &pfcp_message.pfcp_association_setup_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_association_setup_request;
 
     rv = ogs_pfcp_sockaddr_to_node_id(
             ogs_pfcp_self()->pfcp_addr, ogs_pfcp_self()->pfcp_addr6,
@@ -72,6 +100,7 @@ ogs_pkbuf_t *ogs_pfcp_cp_build_association_setup_request(uint8_t type)
             &node_id, &node_id_len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_node_id() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     req->node_id.presence = 1;
@@ -84,23 +113,34 @@ ogs_pkbuf_t *ogs_pfcp_cp_build_association_setup_request(uint8_t type)
     req->cp_function_features.presence = 1;
     req->cp_function_features.u8 = ogs_pfcp_self()->cp_function_features.octet5;
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }
 
 ogs_pkbuf_t *ogs_pfcp_cp_build_association_setup_response(uint8_t type,
         uint8_t cause)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_association_setup_response_t *rsp = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_pfcp_node_id_t node_id;
     int node_id_len = 0, rv;
 
     ogs_debug("Association Setup Response");
 
-    rsp = &pfcp_message.pfcp_association_setup_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_association_setup_response;
 
     rv = ogs_pfcp_sockaddr_to_node_id(
             ogs_pfcp_self()->pfcp_addr, ogs_pfcp_self()->pfcp_addr6,
@@ -108,6 +148,7 @@ ogs_pkbuf_t *ogs_pfcp_cp_build_association_setup_response(uint8_t type,
             &node_id, &node_id_len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_node_id() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     rsp->node_id.presence = 1;
@@ -123,14 +164,20 @@ ogs_pkbuf_t *ogs_pfcp_cp_build_association_setup_response(uint8_t type,
     rsp->cp_function_features.presence = 1;
     rsp->cp_function_features.u8 = ogs_pfcp_self()->cp_function_features.octet5;
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }
 
 ogs_pkbuf_t *ogs_pfcp_up_build_association_setup_request(uint8_t type)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_association_setup_request_t *req = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_pfcp_node_id_t node_id;
     int node_id_len = 0;
@@ -142,8 +189,13 @@ ogs_pkbuf_t *ogs_pfcp_up_build_association_setup_request(uint8_t type)
 
     ogs_debug("Association Setup Request");
 
-    req = &pfcp_message.pfcp_association_setup_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_association_setup_request;
 
     rv = ogs_pfcp_sockaddr_to_node_id(
             ogs_pfcp_self()->pfcp_addr, ogs_pfcp_self()->pfcp_addr6,
@@ -151,6 +203,7 @@ ogs_pkbuf_t *ogs_pfcp_up_build_association_setup_request(uint8_t type)
             &node_id, &node_id_len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_node_id() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     req->node_id.presence = 1;
@@ -181,15 +234,21 @@ ogs_pkbuf_t *ogs_pfcp_up_build_association_setup_request(uint8_t type)
         }
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }
 
 ogs_pkbuf_t *ogs_pfcp_up_build_association_setup_response(uint8_t type,
         uint8_t cause)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_association_setup_response_t *rsp = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_pfcp_node_id_t node_id;
     int node_id_len = 0;
@@ -201,8 +260,13 @@ ogs_pkbuf_t *ogs_pfcp_up_build_association_setup_response(uint8_t type,
 
     ogs_debug("Association Setup Response");
 
-    rsp = &pfcp_message.pfcp_association_setup_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_association_setup_response;
 
     rv = ogs_pfcp_sockaddr_to_node_id(
             ogs_pfcp_self()->pfcp_addr, ogs_pfcp_self()->pfcp_addr6,
@@ -210,6 +274,7 @@ ogs_pkbuf_t *ogs_pfcp_up_build_association_setup_response(uint8_t type,
             &node_id, &node_id_len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_node_id() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     rsp->node_id.presence = 1;
@@ -243,8 +308,13 @@ ogs_pkbuf_t *ogs_pfcp_up_build_association_setup_response(uint8_t type,
         }
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }
 
 static struct {
@@ -817,8 +887,9 @@ static struct {
 ogs_pkbuf_t *ogs_pfcp_build_session_report_request(
         uint8_t type, ogs_pfcp_user_plane_report_t *report)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_report_request_t *req = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
     ogs_pfcp_downlink_data_service_information_t info;
     unsigned int i;
 
@@ -826,8 +897,13 @@ ogs_pkbuf_t *ogs_pfcp_build_session_report_request(
 
     ogs_debug("PFCP session report request");
 
-    req = &pfcp_message.pfcp_session_report_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_session_report_request;
 
     req->report_type.presence = 1;
     req->report_type.u8 = report->type.value;
@@ -938,39 +1014,61 @@ ogs_pkbuf_t *ogs_pfcp_build_session_report_request(
             report->error_indication.remote_f_teid_len;
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }
 
 ogs_pkbuf_t *ogs_pfcp_build_session_report_response(
         uint8_t type, uint8_t cause)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_report_response_t *rsp = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_debug("PFCP session report response");
 
-    rsp = &pfcp_message.pfcp_session_report_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_session_report_response;
 
     rsp->cause.presence = 1;
     rsp->cause.u8 = cause;
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }
 
 ogs_pkbuf_t *ogs_pfcp_build_session_deletion_response( uint8_t type, uint8_t cause,
         ogs_pfcp_user_plane_report_t *report)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_deletion_response_t *rsp = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
     unsigned int i;
 
     ogs_debug("PFCP session deletion response");
 
-    rsp = &pfcp_message.pfcp_session_deletion_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_session_deletion_response;
 
     rsp->cause.presence = 1;
     rsp->cause.u8 = cause;
@@ -1025,6 +1123,11 @@ ogs_pkbuf_t *ogs_pfcp_build_session_deletion_response( uint8_t type, uint8_t cau
             }
         }
     }
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }

src/sgwc/sxa-build.c

@@ -22,7 +22,7 @@
 ogs_pkbuf_t *sgwc_sxa_build_session_establishment_request(
         uint8_t type, sgwc_sess_t *sess)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_establishment_request_t *req = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -39,8 +39,13 @@ ogs_pkbuf_t *sgwc_sxa_build_session_establishment_request(
     ogs_debug("Session Establishment Request");
     ogs_assert(sess);
 
-    req = &pfcp_message.pfcp_session_establishment_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_session_establishment_request;
 
     /* Node ID */
     rv = ogs_pfcp_sockaddr_to_node_id(
@@ -49,6 +54,7 @@ ogs_pkbuf_t *sgwc_sxa_build_session_establishment_request(
             &node_id, &len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_node_id() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     req->node_id.presence = 1;
@@ -61,6 +67,7 @@ ogs_pkbuf_t *sgwc_sxa_build_session_establishment_request(
             &f_seid, &len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_f_seid() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     f_seid.seid = htobe64(sess->sgwc_sxa_seid);
@@ -103,10 +110,12 @@ ogs_pkbuf_t *sgwc_sxa_build_session_establishment_request(
         ogs_pfcp_build_create_bar(&req->create_bar, sess->pfcp.bar);
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     ogs_pfcp_pdrbuf_clear();
+    ogs_free(pfcp_message);
 
     return pkbuf;
 }
@@ -114,7 +123,7 @@ ogs_pkbuf_t *sgwc_sxa_build_session_establishment_request(
 ogs_pkbuf_t *sgwc_sxa_build_bearer_to_modify_list(
         uint8_t type, sgwc_sess_t *sess, ogs_pfcp_xact_t *xact)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_modification_request_t *req = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -138,8 +147,13 @@ ogs_pkbuf_t *sgwc_sxa_build_bearer_to_modify_list(
     modify_flags = xact->modify_flags;
     ogs_assert(modify_flags);
 
-    req = &pfcp_message.pfcp_session_modification_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_session_modification_request;
 
     if (modify_flags & OGS_PFCP_MODIFY_CREATE) {
         ogs_pfcp_pdrbuf_init();
@@ -254,24 +268,39 @@ ogs_pkbuf_t *sgwc_sxa_build_bearer_to_modify_list(
         }
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     if (modify_flags & OGS_PFCP_MODIFY_CREATE) {
         ogs_pfcp_pdrbuf_clear();
     }
 
+    ogs_free(pfcp_message);
+
     return pkbuf;
 }
 
 ogs_pkbuf_t *sgwc_sxa_build_session_deletion_request(
         uint8_t type, sgwc_sess_t *sess)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_debug("Session Deletion Request");
     ogs_assert(sess);
 
-    pfcp_message.h.type = type;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    return ogs_pfcp_build_msg(&pfcp_message);
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    pfcp_message->h.type = type;
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }

src/sgwu/sxa-build.c

@@ -22,7 +22,7 @@
 ogs_pkbuf_t *sgwu_sxa_build_session_establishment_response(uint8_t type,
     sgwu_sess_t *sess, ogs_pfcp_pdr_t *created_pdr[], int num_of_created_pdr)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_establishment_response_t *rsp = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -34,8 +34,13 @@ ogs_pkbuf_t *sgwu_sxa_build_session_establishment_response(uint8_t type,
 
     ogs_debug("Session Establishment Response");
 
-    rsp = &pfcp_message.pfcp_session_establishment_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_session_establishment_response;
 
     /* Node ID */
     rv = ogs_pfcp_sockaddr_to_node_id(
@@ -44,6 +49,7 @@ ogs_pkbuf_t *sgwu_sxa_build_session_establishment_response(uint8_t type,
             &node_id, &len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_node_id() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     rsp->node_id.presence = 1;
@@ -60,6 +66,7 @@ ogs_pkbuf_t *sgwu_sxa_build_session_establishment_response(uint8_t type,
             &f_seid, &len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_f_seid() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     f_seid.seid = htobe64(sess->sgwu_sxa_seid);
@@ -76,10 +83,12 @@ ogs_pkbuf_t *sgwu_sxa_build_session_establishment_response(uint8_t type,
         if (pdr_presence == true) j++;
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     ogs_pfcp_pdrbuf_clear();
+    ogs_free(pfcp_message);
 
     return pkbuf;
 }
@@ -87,7 +96,7 @@ ogs_pkbuf_t *sgwu_sxa_build_session_establishment_response(uint8_t type,
 ogs_pkbuf_t *sgwu_sxa_build_session_modification_response(uint8_t type,
     sgwu_sess_t *sess, ogs_pfcp_pdr_t *created_pdr[], int num_of_created_pdr)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_modification_response_t *rsp = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -95,8 +104,13 @@ ogs_pkbuf_t *sgwu_sxa_build_session_modification_response(uint8_t type,
 
     ogs_debug("Session Modification Response");
 
-    rsp = &pfcp_message.pfcp_session_modification_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_session_modification_response;
 
     /* Cause */
     rsp->cause.presence = 1;
@@ -111,10 +125,12 @@ ogs_pkbuf_t *sgwu_sxa_build_session_modification_response(uint8_t type,
         if (pdr_presence == true) j++;
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     ogs_pfcp_pdrbuf_clear();
+    ogs_free(pfcp_message);
 
     return pkbuf;
 }
@@ -122,18 +138,29 @@ ogs_pkbuf_t *sgwu_sxa_build_session_modification_response(uint8_t type,
 ogs_pkbuf_t *sgwu_sxa_build_session_deletion_response(uint8_t type,
         sgwu_sess_t *sess)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_deletion_response_t *rsp = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_debug("Session Deletion Response");
 
-    rsp = &pfcp_message.pfcp_session_deletion_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_session_deletion_response;
 
     /* Cause */
     rsp->cause.presence = 1;
     rsp->cause.u8 = OGS_PFCP_CAUSE_REQUEST_ACCEPTED;
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    return ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }

src/smf/n4-build.c

@@ -23,7 +23,7 @@
 ogs_pkbuf_t *smf_n4_build_session_establishment_request(
         uint8_t type, smf_sess_t *sess)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_establishment_request_t *req = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -47,8 +47,13 @@ ogs_pkbuf_t *smf_n4_build_session_establishment_request(
     smf_ue = sess->smf_ue;
     ogs_assert(smf_ue);
 
-    req = &pfcp_message.pfcp_session_establishment_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_session_establishment_request;
 
     /* Node ID */
     rv = ogs_pfcp_sockaddr_to_node_id(
@@ -57,6 +62,7 @@ ogs_pkbuf_t *smf_n4_build_session_establishment_request(
             &node_id, &len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_node_id() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     req->node_id.presence = 1;
@@ -69,6 +75,7 @@ ogs_pkbuf_t *smf_n4_build_session_establishment_request(
             &f_seid, &len);
     if (rv != OGS_OK) {
         ogs_error("ogs_pfcp_sockaddr_to_f_seid() failed");
+        ogs_free(pfcp_message);
         return NULL;
     }
     f_seid.seid = htobe64(sess->smf_n4_seid);
@@ -155,10 +162,12 @@ ogs_pkbuf_t *smf_n4_build_session_establishment_request(
         req->s_nssai.data = &sess->s_nssai;
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     ogs_pfcp_pdrbuf_clear();
+    ogs_free(pfcp_message);
 
     return pkbuf;
 }
@@ -170,7 +179,7 @@ ogs_pkbuf_t *smf_n4_build_pdr_to_modify_list(
     ogs_pfcp_urr_t *urr = NULL;
     int i;
 
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_modification_request_t *req = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -188,8 +197,13 @@ ogs_pkbuf_t *smf_n4_build_pdr_to_modify_list(
     modify_flags = xact->modify_flags;
     ogs_assert(modify_flags);
 
-    req = &pfcp_message.pfcp_session_modification_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_session_modification_request;
 
     if (modify_flags & OGS_PFCP_MODIFY_CREATE) {
         ogs_pfcp_pdrbuf_init();
@@ -281,20 +295,23 @@ ogs_pkbuf_t *smf_n4_build_pdr_to_modify_list(
         i++;
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     if (modify_flags & OGS_PFCP_MODIFY_CREATE) {
         ogs_pfcp_pdrbuf_clear();
     }
 
+    ogs_free(pfcp_message);
+
     return pkbuf;
 }
 
 ogs_pkbuf_t *smf_n4_build_qos_flow_to_modify_list(
         uint8_t type, smf_sess_t *sess, ogs_pfcp_xact_t *xact)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_modification_request_t *req = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -319,8 +336,13 @@ ogs_pkbuf_t *smf_n4_build_qos_flow_to_modify_list(
     modify_flags = xact->modify_flags;
     ogs_assert(modify_flags);
 
-    req = &pfcp_message.pfcp_session_modification_request;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    req = &pfcp_message->pfcp_session_modification_request;
 
     if (modify_flags &
             (OGS_PFCP_MODIFY_CREATE|
@@ -491,8 +513,9 @@ ogs_pkbuf_t *smf_n4_build_qos_flow_to_modify_list(
         }
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     if (modify_flags &
             (OGS_PFCP_MODIFY_CREATE|
@@ -502,17 +525,31 @@ ogs_pkbuf_t *smf_n4_build_qos_flow_to_modify_list(
         ogs_pfcp_pdrbuf_clear();
     }
 
+    ogs_free(pfcp_message);
+
     return pkbuf;
 }
 
 ogs_pkbuf_t *smf_n4_build_session_deletion_request(
         uint8_t type, smf_sess_t *sess)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
+    ogs_pkbuf_t *pkbuf = NULL;
 
     ogs_debug("Session Deletion Request");
     ogs_assert(sess);
 
-    pfcp_message.h.type = type;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    return ogs_pfcp_build_msg(&pfcp_message);
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    pfcp_message->h.type = type;
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
+
+    ogs_free(pfcp_message);
+
+    return pkbuf;
 }

src/upf/n4-build.c

@@ -23,7 +23,7 @@
 ogs_pkbuf_t *upf_n4_build_session_establishment_response(uint8_t type,
     upf_sess_t *sess, ogs_pfcp_pdr_t *created_pdr[], int num_of_created_pdr)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_establishment_response_t *rsp = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -35,8 +35,13 @@ ogs_pkbuf_t *upf_n4_build_session_establishment_response(uint8_t type,
 
     ogs_debug("Session Establishment Response");
 
-    rsp = &pfcp_message.pfcp_session_establishment_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_session_establishment_response;
 
     /* Node ID */
     ogs_pfcp_sockaddr_to_node_id(
@@ -69,10 +74,12 @@ ogs_pkbuf_t *upf_n4_build_session_establishment_response(uint8_t type,
         if (pdr_presence == true) j++;
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     ogs_pfcp_pdrbuf_clear();
+    ogs_free(pfcp_message);
 
     return pkbuf;
 }
@@ -80,7 +87,7 @@ ogs_pkbuf_t *upf_n4_build_session_establishment_response(uint8_t type,
 ogs_pkbuf_t *upf_n4_build_session_modification_response(uint8_t type,
     upf_sess_t *sess, ogs_pfcp_pdr_t *created_pdr[], int num_of_created_pdr)
 {
-    ogs_pfcp_message_t pfcp_message;
+    ogs_pfcp_message_t *pfcp_message = NULL;
     ogs_pfcp_session_modification_response_t *rsp = NULL;
     ogs_pkbuf_t *pkbuf = NULL;
 
@@ -88,8 +95,13 @@ ogs_pkbuf_t *upf_n4_build_session_modification_response(uint8_t type,
 
     ogs_debug("Session Modification Response");
 
-    rsp = &pfcp_message.pfcp_session_modification_response;
+    pfcp_message = ogs_calloc(1, sizeof(*pfcp_message));
-    memset(&pfcp_message, 0, sizeof(ogs_pfcp_message_t));
+    if (!pfcp_message) {
+        ogs_error("ogs_calloc() failed");
+        return NULL;
+    }
+
+    rsp = &pfcp_message->pfcp_session_modification_response;
 
     /* Cause */
     rsp->cause.presence = 1;
@@ -104,10 +116,12 @@ ogs_pkbuf_t *upf_n4_build_session_modification_response(uint8_t type,
         if (pdr_presence == true) j++;
     }
 
-    pfcp_message.h.type = type;
+    pfcp_message->h.type = type;
-    pkbuf = ogs_pfcp_build_msg(&pfcp_message);
+    pkbuf = ogs_pfcp_build_msg(pfcp_message);
+    ogs_expect(pkbuf);
 
     ogs_pfcp_pdrbuf_clear();
+    ogs_free(pfcp_message);
 
     return pkbuf;
 }