sysmocom
/
open5gs
forked from acouzens/open5gs
11
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[Security] Fixed a crash for port scanning (#1767)

This commit is contained in:
Sukchan Lee 2022-10-01 13:28:41 +09:00
parent 1acb7f72b4
commit 71a1516b03
6 changed files with 18 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/core/ogs-tlv-msg.c
View File

@ -759,7 +759,15 @@ static ogs_tlv_t *ogs_tlv_parse_block_desc(uint32_t length, void *data, uint8_t
ogs_assert(pos);
}
ogs_assert(length == (pos - blk));
if (length != (pos - blk)) {
ogs_error("ogs_tlv_parse_block() failed[LEN:%d,MODE:%d]",
length, msg_mode);
ogs_error("POS[%p] BLK[%p] POS-BLK[%d]", pos, blk, (int)(pos - blk));
ogs_log_hexdump(OGS_LOG_FATAL, data, length);
ogs_tlv_free_all(root);
return NULL;
}
return root;
}

7
lib/core/ogs-tlv.c
View File

@ -462,9 +462,12 @@ ogs_tlv_t *ogs_tlv_parse_block(uint32_t length, void *data, uint8_t mode)
}
if (length != (pos - blk)) {
ogs_fatal("ogs_tlv_parse_block() failed[LEN:%d,MODE:%d]", length, mode);
ogs_error("ogs_tlv_parse_block() failed[LEN:%d,MODE:%d]", length, mode);
ogs_error("POS[%p] BLK[%p] POS-BLK[%d]", pos, blk, (int)(pos - blk));
ogs_log_hexdump(OGS_LOG_FATAL, data, length);
ogs_assert_if_reached();
ogs_tlv_free_all(root);
return NULL;
}
return root;

2
src/sgwc/pfcp-path.c
View File

@ -80,7 +80,7 @@ static void pfcp_recv_cb(short when, ogs_socket_t fd, void *data)
ogs_pkbuf_trim(pkbuf, size);
h = (ogs_pfcp_header_t *)pkbuf->data;
if (h->version > OGS_PFCP_VERSION) {
if (h->version != OGS_PFCP_VERSION) {
ogs_pfcp_header_t rsp;
ogs_error("Not supported version[%d]", h->version);

2
src/sgwu/pfcp-path.c
View File

@ -80,7 +80,7 @@ static void pfcp_recv_cb(short when, ogs_socket_t fd, void *data)
ogs_pkbuf_trim(pkbuf, size);
h = (ogs_pfcp_header_t *)pkbuf->data;
if (h->version > OGS_PFCP_VERSION) {
if (h->version != OGS_PFCP_VERSION) {
ogs_pfcp_header_t rsp;
ogs_error("Not supported version[%d]", h->version);

2
src/smf/pfcp-path.c
View File

@ -120,7 +120,7 @@ static void pfcp_recv_cb(short when, ogs_socket_t fd, void *data)
ogs_pkbuf_trim(pkbuf, size);
h = (ogs_pfcp_header_t *)pkbuf->data;
if (h->version > OGS_PFCP_VERSION) {
if (h->version != OGS_PFCP_VERSION) {
ogs_pfcp_header_t rsp;
ogs_error("Not supported version[%d]", h->version);

2
src/upf/pfcp-path.c
View File

@ -83,7 +83,7 @@ static void pfcp_recv_cb(short when, ogs_socket_t fd, void *data)
ogs_pkbuf_trim(pkbuf, size);
h = (ogs_pfcp_header_t *)pkbuf->data;
if (h->version > OGS_PFCP_VERSION) {
if (h->version != OGS_PFCP_VERSION) {
ogs_pfcp_header_t rsp;
ogs_error("Not supported version[%d]", h->version);