sysmocom
/
open5gs
forked from acouzens/open5gs
11
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[UPF] Fixed an infinte loop when ext_len is 0

This commit is contained in:
Sukchan Lee 2022-11-30 16:40:57 +09:00
parent b9c6906017
commit 0861a045ef
1 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
lib/gtp/util.c
View File

@ -31,12 +31,20 @@ int ogs_gtpu_header_len(ogs_pkbuf_t *pkbuf)
gtp_h = (ogs_gtp2_header_t *)pkbuf->data;
len = OGS_GTPV1U_HEADER_LEN;
if (pkbuf->len < len) return -1;
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);
return -1;
}
if (gtp_h->flags & OGS_GTPU_FLAGS_E) {
len += OGS_GTPV1U_EXTENSION_HEADER_LEN;
if (pkbuf->len < len) return -1;
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);
return -1;
}
/*
* TS29.281
@ -51,7 +59,15 @@ int ogs_gtpu_header_len(ogs_pkbuf_t *pkbuf)
* where n is a positive integer.
*/
len += (*(++ext_h)) * 4;
if (pkbuf->len < len) return -1;
if (*ext_h == 0) {
ogs_error("No length in the Extension header");
return -1;
}
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);
return -1;
}
}
} else if (gtp_h->flags & (OGS_GTPU_FLAGS_S|OGS_GTPU_FLAGS_PN)) {
@ -68,7 +84,11 @@ int ogs_gtpu_header_len(ogs_pkbuf_t *pkbuf)
len += 4;
}
if (pkbuf->len < len) return -1;
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);
return -1;
}
return len;
}