diff --git a/src/sgwu/gtp-path.c b/src/sgwu/gtp-path.c index c523e3e3c5..b72f1aa5db 100644 --- a/src/sgwu/gtp-path.c +++ b/src/sgwu/gtp-path.c @@ -124,6 +124,12 @@ static void _gtpv1_u_recv_cb(short when, ogs_socket_t fd, void *data) ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len); goto cleanup; } + if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER && + pkbuf->len <= len) { + ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len); + ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len); + goto cleanup; + } ogs_assert(ogs_pkbuf_pull(pkbuf, len)); if (gtp_h->type == OGS_GTPU_MSGTYPE_END_MARKER) { diff --git a/src/smf/gtp-path.c b/src/smf/gtp-path.c index 8e825fe62c..821341ce83 100644 --- a/src/smf/gtp-path.c +++ b/src/smf/gtp-path.c @@ -186,6 +186,12 @@ static void _gtpv1_u_recv_cb(short when, ogs_socket_t fd, void *data) ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len); goto cleanup; } + if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER && + pkbuf->len <= len) { + ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len); + ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len); + goto cleanup; + } ogs_assert(ogs_pkbuf_pull(pkbuf, len)); if (gtp_h->type == OGS_GTPU_MSGTYPE_GPDU) { diff --git a/src/upf/gtp-path.c b/src/upf/gtp-path.c index b18b7c51b9..95bb5b99ac 100644 --- a/src/upf/gtp-path.c +++ b/src/upf/gtp-path.c @@ -304,6 +304,12 @@ static void _gtpv1_u_recv_cb(short when, ogs_socket_t fd, void *data) ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len); goto cleanup; } + if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER && + pkbuf->len <= len) { + ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len); + ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len); + goto cleanup; + } ogs_assert(ogs_pkbuf_pull(pkbuf, len)); if (gtp_h->type == OGS_GTPU_MSGTYPE_END_MARKER) {