fix overflow bug in the packet memory pool

lib/asn1c/util/message.c

@@ -28,6 +28,7 @@ ogs_pkbuf_t *ogs_asn_encode(const asn_TYPE_descriptor_t *td, void *sptr)
     ogs_assert(sptr);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     enc_ret = aper_encode_to_buffer(td, NULL,

lib/core/ogs-memory.c

@@ -31,6 +31,7 @@ void *ogs_malloc(size_t size)
 
     headroom = sizeof(ogs_pkbuf_t *);
     pkbuf = ogs_pkbuf_alloc(NULL, headroom + size);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, headroom);
     memcpy(pkbuf->head, &pkbuf, headroom);
     ogs_pkbuf_put(pkbuf, size);

lib/core/ogs-pkbuf.c

@@ -175,6 +175,10 @@ ogs_pkbuf_t *ogs_pkbuf_alloc(ogs_pkbuf_pool_t *pool, unsigned int size)
     ogs_thread_mutex_lock(&pool->mutex);
 
     cluster = cluster_alloc(pool, size);
+    if (!cluster) {
+        ogs_error("ogs_pkbuf_alloc() failed [size=%d]", size);
+        return NULL;
+    }
     ogs_assert(cluster);
 
     ogs_pool_alloc(&pool->pkbuf, &pkbuf);
@@ -257,31 +261,51 @@ static ogs_cluster_t *cluster_alloc(
 
     if (size <= OGS_CLUSTER_128_SIZE) {
         ogs_pool_alloc(&pool->cluster_128, (ogs_cluster_128_t**)&buffer);
-        ogs_assert(buffer);
+        if (!buffer) {
+            ogs_fatal("No OGS_CLUSTER_128_SIZE");
+            return NULL;
+        }
         cluster->size = OGS_CLUSTER_128_SIZE;
     } else if (size <= OGS_CLUSTER_256_SIZE) {
         ogs_pool_alloc(&pool->cluster_256, (ogs_cluster_256_t**)&buffer);
-        ogs_assert(buffer);
+        if (!buffer) {
+            ogs_fatal("No OGS_CLUSTER_256_SIZE");
+            return NULL;
+        }
         cluster->size = OGS_CLUSTER_256_SIZE;
     } else if (size <= OGS_CLUSTER_512_SIZE) {
         ogs_pool_alloc(&pool->cluster_512, (ogs_cluster_512_t**)&buffer);
-        ogs_assert(buffer);
+        if (!buffer) {
+            ogs_fatal("No OGS_CLUSTER_512_SIZE");
+            return NULL;
+        }
         cluster->size = OGS_CLUSTER_512_SIZE;
     } else if (size <= OGS_CLUSTER_1024_SIZE) {
         ogs_pool_alloc(&pool->cluster_1024, (ogs_cluster_1024_t**)&buffer);
-        ogs_assert(buffer);
+        if (!buffer) {
+            ogs_fatal("No OGS_CLUSTER_1024_SIZE");
+            return NULL;
+        }
         cluster->size = OGS_CLUSTER_1024_SIZE;
     } else if (size <= OGS_CLUSTER_2048_SIZE) {
         ogs_pool_alloc(&pool->cluster_2048, (ogs_cluster_2048_t**)&buffer);
-        ogs_assert(buffer);
+        if (!buffer) {
+            ogs_fatal("No OGS_CLUSTER_2048_SIZE");
+            return NULL;
+        }
         cluster->size = OGS_CLUSTER_2048_SIZE;
     } else if (size <= OGS_CLUSTER_8192_SIZE) {
         ogs_pool_alloc(&pool->cluster_8192, (ogs_cluster_8192_t**)&buffer);
-        ogs_assert(buffer);
+        if (!buffer) {
+            ogs_fatal("No OGS_CLUSTER_8192_SIZE");
+            return NULL;
+        }
         cluster->size = OGS_CLUSTER_8192_SIZE;
     } else if (size <= OGS_CLUSTER_BIG_SIZE) {
         ogs_pool_alloc(&pool->cluster_big, (ogs_cluster_big_t**)&buffer);
-        ogs_assert(buffer);
+        if (!buffer) {
+            ogs_fatal("No OGS_CLUSTER_BIG_SIZE");
+        }
         cluster->size = OGS_CLUSTER_BIG_SIZE;
     } else {
         ogs_fatal("invalid size = %d", size);

lib/gtp/path.c

@@ -140,6 +140,7 @@ ogs_pkbuf_t *ogs_gtp_handle_echo_req(ogs_pkbuf_t *pkb)
 
     pkb_resp = ogs_pkbuf_alloc(NULL,
             100 /* enough for ECHO_RSP; use smaller buffer */);
+    ogs_assert(pkb_resp);
     ogs_pkbuf_put(pkb_resp, 100);
     gtph_resp = (ogs_gtp_header_t *)pkb_resp->data;
 

lib/pfcp/context.h

@@ -160,7 +160,7 @@ typedef struct ogs_pfcp_far_s {
 
     ogs_pfcp_smreq_flags_t  smreq_flags;
 
-#define MAX_NUM_OF_PACKET_BUFFER 512
+#define MAX_NUM_OF_PACKET_BUFFER 48
     uint32_t                num_of_buffered_packet;
     ogs_pkbuf_t*            buffered_packet[MAX_NUM_OF_PACKET_BUFFER];
 
@@ -169,6 +169,15 @@ typedef struct ogs_pfcp_far_s {
     void                    *gnode;
 } ogs_pfcp_far_t;
 
+/*
+ * Note that buffer size 48 should not be modified. To modify this value,
+ * we need to consider the overflow of the FAR memory pool.
+ *
+ * 8192 memory pool is currently being used.
+ * If you want to, you need to add big memory pool for FAR memory.
+ */
+OGS_STATIC_ASSERT((sizeof(ogs_pfcp_far_t) * OGS_MAX_NUM_OF_FAR) < 8192);
+
 typedef struct ogs_pfcp_urr_s {
     ogs_lnode_t             lnode;
     uint32_t                index;

lib/pfcp/path.c

@@ -362,6 +362,7 @@ void ogs_pfcp_send_end_marker(ogs_pfcp_pdr_t *pdr)
 
     sendbuf = ogs_pkbuf_alloc(NULL,
             100 /* enough for END_MARKER; use smaller buffer */);
+    ogs_assert(sendbuf);
     ogs_pkbuf_put(sendbuf, 100);
     memset(sendbuf->data, 0, sendbuf->len);
 

lib/sbi/message.c

@@ -1506,6 +1506,7 @@ static int parse_multipart(
                 data.part[i].content_type;
             http->part[http->num_of_part].pkbuf =
                 ogs_pkbuf_alloc(NULL, data.part[i].content_length);
+            ogs_assert(http->part[http->num_of_part].pkbuf);
             ogs_pkbuf_put_data(http->part[http->num_of_part].pkbuf,
                 data.part[i].content, data.part[i].content_length);
 

src/amf/gmm-handler.c

@@ -975,6 +975,7 @@ static int gmm_handle_nas_message_container(amf_ue_t *amf_ue,
     }
 
     nasbuf = ogs_pkbuf_alloc(NULL, nas_message_container->length);
+    ogs_assert(nasbuf);
     ogs_pkbuf_put_data(nasbuf,
             nas_message_container->buffer, nas_message_container->length);
 

src/amf/ngap-handler.c

@@ -791,6 +791,7 @@ void ngap_handle_initial_context_setup_response(
 
         memset(&param, 0, sizeof(param));
         param.n2smbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+        ogs_assert(param.n2smbuf);
         param.n2SmInfoType = OpenAPI_n2_sm_info_type_PDU_RES_SETUP_RSP;
         ogs_pkbuf_put_data(param.n2smbuf, transfer->buf, transfer->size);
 
@@ -1473,6 +1474,7 @@ void ngap_handle_pdu_session_resource_setup_response(
 
         memset(&param, 0, sizeof(param));
         param.n2smbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+        ogs_assert(param.n2smbuf);
         param.n2SmInfoType = OpenAPI_n2_sm_info_type_PDU_RES_SETUP_RSP;
         ogs_pkbuf_put_data(param.n2smbuf, transfer->buf, transfer->size);
 
@@ -1636,6 +1638,7 @@ void ngap_handle_pdu_session_resource_release_response(
 
         memset(&param, 0, sizeof(param));
         param.n2smbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+        ogs_assert(param.n2smbuf);
         param.n2SmInfoType = OpenAPI_n2_sm_info_type_PDU_RES_REL_RSP;
         ogs_pkbuf_put_data(param.n2smbuf, transfer->buf, transfer->size);
 

src/amf/ngap-path.c

@@ -169,6 +169,7 @@ int ngap_send_to_nas(ran_ue_t *ran_ue,
     /* The Packet Buffer(pkbuf_t) for NAS message MUST make a HEADROOM. 
      * When calculating AES_CMAC, we need to use the headroom of the packet. */
     nasbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+nasPdu->size);
+    ogs_assert(nasbuf);
     ogs_pkbuf_reserve(nasbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(nasbuf, nasPdu->buf, nasPdu->size);
 

src/amf/ngap-sctp.c

@@ -126,6 +126,7 @@ void ngap_recv_handler(ogs_sock_t *sock)
     ogs_assert(sock);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
     size = ogs_sctp_recvmsg(
             sock, pkbuf->data, pkbuf->len, &from, &sinfo, &flags);

src/mme/mme-fd-path.c

@@ -227,6 +227,7 @@ static void mme_s6a_aia_cb(void *data, struct msg **msg)
     s6abuf_len = sizeof(ogs_diam_s6a_message_t);
     ogs_assert(s6abuf_len < 8192);
     s6abuf = ogs_pkbuf_alloc(NULL, s6abuf_len);
+    ogs_assert(s6abuf);
     ogs_pkbuf_put(s6abuf, s6abuf_len);
     s6a_message = (ogs_diam_s6a_message_t *)s6abuf->data;
     ogs_assert(s6a_message);
@@ -638,6 +639,7 @@ static void mme_s6a_ula_cb(void *data, struct msg **msg)
     s6abuf_len = sizeof(ogs_diam_s6a_message_t);
     ogs_assert(s6abuf_len < 8192);
     s6abuf = ogs_pkbuf_alloc(NULL, s6abuf_len);
+    ogs_assert(s6abuf);
     ogs_pkbuf_put(s6abuf, s6abuf_len);
     s6a_message = (ogs_diam_s6a_message_t *)s6abuf->data;
     ogs_assert(s6a_message);

src/mme/mme-gtp-path.c

@@ -40,6 +40,7 @@ static void _gtpv2_c_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);
@@ -432,6 +433,7 @@ void mme_gtp_send_delete_indirect_data_forwarding_tunnel_request(
     h.teid = mme_ue->sgw_s11_teid;
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_TLV_MAX_HEADROOM);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, OGS_TLV_MAX_HEADROOM);
 
     xact = ogs_gtp_xact_local_create(mme_ue->gnode, &h, pkbuf, timeout, mme_ue);

src/mme/nas-path.c

@@ -51,6 +51,7 @@ int nas_eps_send_emm_to_esm(mme_ue_t *mme_ue,
      * When calculating AES_CMAC, we need to use the headroom of the packet. */
     esmbuf = ogs_pkbuf_alloc(NULL,
             OGS_NAS_HEADROOM+esm_message_container->length);
+    ogs_assert(esmbuf);
     ogs_pkbuf_reserve(esmbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(esmbuf,
             esm_message_container->buffer, esm_message_container->length);

src/mme/s1ap-path.c

@@ -170,6 +170,7 @@ int s1ap_send_to_nas(enb_ue_t *enb_ue,
     /* The Packet Buffer(pkbuf_t) for NAS message MUST make a HEADROOM. 
      * When calculating AES_CMAC, we need to use the headroom of the packet. */
     nasbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+nasPdu->size);
+    ogs_assert(nasbuf);
     ogs_pkbuf_reserve(nasbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(nasbuf, nasPdu->buf, nasPdu->size);
 

src/mme/s1ap-sctp.c

@@ -127,6 +127,7 @@ void s1ap_recv_handler(ogs_sock_t *sock)
     ogs_assert(sock);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
     size = ogs_sctp_recvmsg(
             sock, pkbuf->data, pkbuf->len, &from, &sinfo, &flags);

src/mme/sgsap-build.c

@@ -58,6 +58,7 @@ ogs_pkbuf_t *sgsap_build_location_update_request(mme_ue_t *mme_ue)
     ogs_tlv_add(root, SGSAP_IE_LAI_TYPE, SGSAP_IE_LAI_LEN, 0, &lai);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, SGSAP_LOCATION_UPDATE_REQUEST);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
@@ -85,6 +86,7 @@ ogs_pkbuf_t *sgsap_build_tmsi_reallocation_complete(mme_ue_t *mme_ue)
             &mme_ue->nas_mobile_identity_imsi);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, SGSAP_TMSI_REALLOCATION_COMPLETE);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
@@ -161,6 +163,7 @@ ogs_pkbuf_t *sgsap_build_detach_indication(mme_ue_t *mme_ue)
     ogs_debug("    INDICATION[%d]", indication);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, type);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
@@ -189,6 +192,7 @@ ogs_pkbuf_t *sgsap_build_mo_csfb_indication(mme_ue_t *mme_ue)
             &mme_ue->nas_mobile_identity_imsi);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, SGSAP_MO_CSFB_INDICIATION);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
@@ -219,6 +223,7 @@ ogs_pkbuf_t *sgsap_build_paging_reject(
     ogs_debug("    CAUSE[%d]", sgs_cause);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, SGSAP_PAGING_REJECT);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
@@ -253,6 +258,7 @@ ogs_pkbuf_t *sgsap_build_service_request(mme_ue_t *mme_ue, uint8_t emm_mode)
             SGSAP_IE_UE_EMM_MODE_LEN, 0, &emm_mode);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, SGSAP_SERVICE_REQUEST);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
@@ -282,6 +288,7 @@ ogs_pkbuf_t *sgsap_build_reset_ack(mme_vlr_t *vlr)
     root = ogs_tlv_add(NULL, SGSAP_IE_MME_NAME_TYPE, mme_name_len, 0, mme_name);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, SGSAP_RESET_ACK);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
@@ -316,6 +323,7 @@ ogs_pkbuf_t *sgsap_build_uplink_unidata(mme_ue_t *mme_ue,
             nas_message_container->length, 0, nas_message_container->buffer);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, SGSAP_UPLINK_UNITDATA);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 
@@ -347,6 +355,7 @@ ogs_pkbuf_t *sgsap_build_ue_unreachable(mme_ue_t *mme_ue, uint8_t sgs_cause)
             SGSAP_IE_SGS_CAUSE_LEN, 0, &sgs_cause);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_u8(pkbuf, SGSAP_UE_UNREACHABLE);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);
 

src/mme/sgsap-sctp.c

@@ -105,6 +105,7 @@ static void recv_handler(ogs_sock_t *sock)
     ogs_assert(sock);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
     size = ogs_sctp_recvmsg(
             sock, pkbuf->data, pkbuf->len, &from, &sinfo, &flags);

src/sgwc/context.c

@@ -592,8 +592,6 @@ sgwc_bearer_t *sgwc_bearer_add(sgwc_sess_t *sess)
 
 int sgwc_bearer_remove(sgwc_bearer_t *bearer)
 {
-    int i;
-
     ogs_assert(bearer);
     ogs_assert(bearer->sess);
 
@@ -601,10 +599,6 @@ int sgwc_bearer_remove(sgwc_bearer_t *bearer)
 
     sgwc_tunnel_remove_all(bearer);
 
-    /* Free the buffered packets */
-    for (i = 0; i < bearer->num_buffered_pkt; i++)
-        ogs_pkbuf_free(bearer->buffered_pkts[i]);
-
     ogs_pool_free(&sgwc_bearer_pool, bearer);
 
     return OGS_OK;

src/sgwc/context.h

@@ -121,12 +121,6 @@ typedef struct sgwc_bearer_s {
 
     uint8_t         ebi;
 
-    /* Pkts which will be buffered in case of UE-IDLE */
-    uint32_t        num_buffered_pkt;
-
-#define MAX_NUM_OF_PACKET_BUFFER      512 
-    ogs_pkbuf_t*    buffered_pkts[MAX_NUM_OF_PACKET_BUFFER];
-
     ogs_list_t      tunnel_list;
     sgwc_sess_t     *sess;
     sgwc_ue_t       *sgwc_ue;

src/sgwc/gtp-path.c

@@ -33,6 +33,7 @@ static void _gtpv2_c_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);

src/sgwc/pfcp-path.c

@@ -71,6 +71,7 @@ static void pfcp_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);

src/sgwu/gtp-path.c

@@ -44,6 +44,7 @@ static void _gtpv1_u_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(packet_pool, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);

src/sgwu/pfcp-path.c

@@ -68,6 +68,7 @@ static void pfcp_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);

src/smf/fd-path.c

@@ -535,6 +535,7 @@ static void smf_gx_cca_cb(void *data, struct msg **msg)
     gxbuf_len = sizeof(ogs_diam_gx_message_t);
     ogs_assert(gxbuf_len < 8192);
     gxbuf = ogs_pkbuf_alloc(NULL, gxbuf_len);
+    ogs_assert(gxbuf);
     ogs_pkbuf_put(gxbuf, gxbuf_len);
     gx_message = (ogs_diam_gx_message_t *)gxbuf->data;
     ogs_assert(gx_message);
@@ -855,6 +856,7 @@ static int smf_gx_rar_cb( struct msg **msg, struct avp *avp,
     gxbuf_len = sizeof(ogs_diam_gx_message_t);
     ogs_assert(gxbuf_len < 8192);
     gxbuf = ogs_pkbuf_alloc(NULL, gxbuf_len);
+    ogs_assert(gxbuf);
     ogs_pkbuf_put(gxbuf, gxbuf_len);
     gx_message = (ogs_diam_gx_message_t *)gxbuf->data;
     ogs_assert(gx_message);

src/smf/gtp-path.c

@@ -37,6 +37,7 @@ static void _gtpv2_c_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);

src/smf/pfcp-path.c

@@ -70,6 +70,7 @@ static void pfcp_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);

src/upf/gtp-path.c

@@ -54,6 +54,7 @@ static void _gtpv1_tun_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_pfcp_user_plane_report_t report;
 
     recvbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(recvbuf);
     ogs_pkbuf_reserve(recvbuf, OGS_GTPV1U_5GC_HEADER_LEN);
     ogs_pkbuf_put(recvbuf, OGS_MAX_SDU_LEN-OGS_GTPV1U_5GC_HEADER_LEN);
 
@@ -102,6 +103,7 @@ static void _gtpv1_u_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);
@@ -433,6 +435,7 @@ static int upf_gtp_send_router_advertisement(
     ogs_assert(dev);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_GTPV1U_5GC_HEADER_LEN+200);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, OGS_GTPV1U_5GC_HEADER_LEN);
     ogs_pkbuf_put(pkbuf, 200);
     pkbuf->len = sizeof *ip6_h + sizeof *advert_h + sizeof *prefix;

src/upf/pfcp-path.c

@@ -71,6 +71,7 @@ static void pfcp_recv_cb(short when, ogs_socket_t fd, void *data)
     ogs_assert(fd != INVALID_SOCKET);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_recvfrom(fd, pkbuf->data, pkbuf->len, 0, &from);

tests/common/gtpu.c

@@ -52,6 +52,7 @@ ogs_pkbuf_t *test_gtpu_read(ogs_socknode_t *node)
 {
     int rc = 0;
     ogs_pkbuf_t *recvbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(recvbuf);
     ogs_pkbuf_put(recvbuf, OGS_MAX_SDU_LEN);
 
     ogs_assert(node);
@@ -123,6 +124,7 @@ int test_gtpu_send_ping(
 
     pkbuf = ogs_pkbuf_alloc(
             NULL, 200 /* enough for ICMP; use smaller buffer */);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, 200);
     memset(pkbuf->data, 0, pkbuf->len);
 
@@ -295,6 +297,7 @@ int test_gtpu_send_slacc_rs(ogs_socknode_t *node, test_bearer_t *bearer)
 
     pkbuf = ogs_pkbuf_alloc(
             NULL, 200 /* enough for ICMP; use smaller buffer */);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, 200);
     memset(pkbuf->data, 0, pkbuf->len);
 

tests/common/nas-path.c

@@ -105,6 +105,7 @@ void testgmm_send_to_gsm(test_sess_t *sess,
     ogs_assert(payload_container->length);
 
     gsmbuf = ogs_pkbuf_alloc(NULL, payload_container->length);
+    ogs_assert(gsmbuf);
     ogs_pkbuf_put_data(gsmbuf,
             payload_container->buffer, payload_container->length);
 
@@ -209,6 +210,7 @@ void testemm_send_to_esm(test_ue_t *test_ue,
     ogs_assert(esm_message_container->buffer);
 
     esmbuf = ogs_pkbuf_alloc(NULL, esm_message_container->length);
+    ogs_assert(esmbuf);
     ogs_pkbuf_put_data(esmbuf,
             esm_message_container->buffer, esm_message_container->length);
 

tests/common/ngap-handler.c

@@ -281,6 +281,7 @@ void testngap_handle_pdu_session_resource_setup_request(
                 ogs_assert(transfer);
 
                 n2smbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+                ogs_assert(n2smbuf);
                 ogs_pkbuf_put_data(n2smbuf, transfer->buf, transfer->size);
 
                 rv = ogs_asn_decode(

tests/common/ngap-path.c

@@ -118,6 +118,7 @@ void testngap_send_to_nas(test_ue_t *test_ue, NGAP_NAS_PDU_t *nasPdu)
     /* The Packet Buffer(pkbuf_t) for NAS message MUST make a HEADROOM. 
      * When calculating AES_CMAC, we need to use the headroom of the packet. */
     nasbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+nasPdu->size);
+    ogs_assert(nasbuf);
     ogs_pkbuf_reserve(nasbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(nasbuf, nasPdu->buf, nasPdu->size);
 

tests/common/s1ap-build.c

@@ -1832,6 +1832,7 @@ ogs_pkbuf_t *test_s1ap_build_invalid_packet(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 
@@ -1875,6 +1876,7 @@ ogs_pkbuf_t *test_s1ap_build_enb_configuration_transfer(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 

tests/common/s1ap-path.c

@@ -141,6 +141,7 @@ void tests1ap_send_to_nas(test_ue_t *test_ue, S1AP_NAS_PDU_t *nasPdu)
     /* The Packet Buffer(pkbuf_t) for NAS message MUST make a HEADROOM. 
      * When calculating AES_CMAC, we need to use the headroom of the packet. */
     nasbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+nasPdu->size);
+    ogs_assert(nasbuf);
     ogs_pkbuf_reserve(nasbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(nasbuf, nasPdu->buf, nasPdu->size);
 

tests/common/sctp.c

@@ -68,6 +68,7 @@ ogs_pkbuf_t *testsctp_read(ogs_socknode_t *node, int type)
     ogs_assert(node->sock);
 
     recvbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(recvbuf);
     ogs_pkbuf_put(recvbuf, OGS_MAX_SDU_LEN);
 
     size = ogs_sctp_recvdata(node->sock, recvbuf->data, OGS_MAX_SDU_LEN,

tests/common/sgsap-build.c

@@ -38,6 +38,7 @@ ogs_pkbuf_t *test_sgsap_location_update_accept(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 
@@ -61,6 +62,7 @@ ogs_pkbuf_t *test_sgsap_location_update_reject(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 
@@ -84,6 +86,7 @@ ogs_pkbuf_t *test_sgsap_imsi_detach_ack(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 
@@ -119,6 +122,7 @@ ogs_pkbuf_t *test_sgsap_paging_request(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 
@@ -142,6 +146,7 @@ ogs_pkbuf_t *test_sgsap_reset_indication(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 
@@ -165,6 +170,7 @@ ogs_pkbuf_t *test_sgsap_release_request(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 
@@ -189,6 +195,7 @@ ogs_pkbuf_t *test_sgsap_downlink_unitdata(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 
@@ -213,6 +220,7 @@ ogs_pkbuf_t *test_sgsap_mm_information_request(int i)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put_data(pkbuf,
         OGS_HEX(payload[i], strlen(payload[i]), hexbuf), len[i]);
 

tests/unit/crash-test.c

@@ -344,6 +344,7 @@ static void test2_func(abts_case *tc, void *data)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     enb_pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(enb_pkbuf);
     ogs_pkbuf_put_data(enb_pkbuf, 
             OGS_HEX(payload, strlen(payload), hexbuf), 38);
 
@@ -370,6 +371,7 @@ static void test3_func(abts_case *tc, void *data)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     enb_pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(enb_pkbuf);
     ogs_pkbuf_put_data(enb_pkbuf, 
             OGS_HEX(payload, strlen(payload), hexbuf), 44);
 
@@ -395,6 +397,7 @@ static void test4_func(abts_case *tc, void *data)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     enb_pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(enb_pkbuf);
     ogs_pkbuf_put_data(enb_pkbuf,
             OGS_HEX(payload, strlen(payload), hexbuf), 59);
 
@@ -418,6 +421,7 @@ static void test5_func(abts_case *tc, void *data)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     enb_pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(enb_pkbuf);
     ogs_pkbuf_put_data(enb_pkbuf,
             OGS_HEX(payload, strlen(payload), hexbuf), 72);
 
@@ -584,6 +588,7 @@ static void test6_func(abts_case *tc, void *data)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     emmbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(emmbuf);
     ogs_pkbuf_put_data(emmbuf,
             OGS_HEX(nas_payload, strlen(nas_payload), hexbuf), 13);
 

tests/unit/nas-message-test.c

@@ -35,6 +35,7 @@ static void ogs_nas_eps_message_test1(abts_case *tc, void *data)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
     ogs_pkbuf_trim(pkbuf, 53);
     memcpy(pkbuf->data, 
@@ -147,6 +148,7 @@ static void ogs_nas_eps_message_test3(abts_case *tc, void *data)
     char hexbuf[OGS_MAX_SDU_LEN];
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
     ogs_pkbuf_trim(pkbuf, 7);
     memcpy(pkbuf->data, 
@@ -210,6 +212,7 @@ static void ogs_nas_eps_message_test6(abts_case *tc, void *data)
     int rv;
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
     ogs_pkbuf_trim(pkbuf, 3);
     memcpy(pkbuf->data, 
@@ -289,6 +292,7 @@ static void ogs_nas_eps_message_test8(abts_case *tc, void *data)
         &service_request->ksi_and_sequence_number;
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN);
     ogs_pkbuf_trim(pkbuf, 4);
     memcpy(pkbuf->data, 

tests/unit/security-test.c

@@ -146,6 +146,7 @@ static void security_test4(abts_case *tc, void *data)
     ABTS_TRUE(tc, memcmp(mact, OGS_HEX(_mact, strlen(_mact), tmp), 4) == 0);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+SECURITY_TEST4_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(pkbuf, message, SECURITY_TEST4_LEN);
 
@@ -191,6 +192,7 @@ static void security_test5(abts_case *tc, void *data)
         SECURITY_TEST5_LEN) == 0);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+SECURITY_TEST5_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(pkbuf, plain, SECURITY_TEST5_LEN);
 
@@ -231,6 +233,7 @@ static void security_test6(abts_case *tc, void *data)
     ABTS_TRUE(tc, memcmp(mact, OGS_HEX(_mact, strlen(_mact), tmp), 4) == 0);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+SECURITY_TEST6_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(pkbuf, message, SECURITY_TEST6_LEN);
 
@@ -285,6 +288,7 @@ static void security_test7(abts_case *tc, void *data)
     ABTS_TRUE(tc, memcmp(cipher, plain, SECURITY_TEST7_LEN) == 0);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+SECURITY_TEST7_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(pkbuf, plain, SECURITY_TEST7_LEN);
 
@@ -326,6 +330,7 @@ static void security_test8(abts_case *tc, void *data)
         OGS_HEX(_mact, strlen(_mact), mact), 4) == 0);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+SECURITY_TEST8_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(pkbuf, message, SECURITY_TEST8_LEN);
 
@@ -370,6 +375,7 @@ static void security_test9(abts_case *tc, void *data)
         SECURITY_TEST9_LEN) == 0);
 
     pkbuf = ogs_pkbuf_alloc(NULL, OGS_NAS_HEADROOM+SECURITY_TEST9_LEN);
+    ogs_assert(pkbuf);
     ogs_pkbuf_reserve(pkbuf, OGS_NAS_HEADROOM);
     ogs_pkbuf_put_data(pkbuf, plain, SECURITY_TEST9_LEN);