sysmocom
/
open5gs
forked from acouzens/open5gs
11
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[GTPU] Fixed Stack-Buffer-Overflow in GTPU (#2609)

This commit is contained in:
Sukchan Lee 2023-09-15 07:15:47 +09:00
parent bfe8ae659e
commit aa746794e7
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/gtp/util.c
View File

@ -76,6 +76,12 @@ int ogs_gtpu_parse_header(
ogs_error("No length in the Extension header");
return -1;
}
if (((*ext_h) * 4) > OGS_GTP2_MAX_EXTENSION_HEADER_LEN) {
ogs_error("Overflow length : %d", (*ext_h));
return -1;
}
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);

4
lib/gtp/v2/types.h
View File

@ -73,6 +73,10 @@ typedef struct ogs_gtp2_extension_header_s {
uint16_t udp_port;
uint16_t pdcp_number;
};
/* sizeof(extension_header.array[i]) */
#define OGS_GTP2_MAX_EXTENSION_HEADER_LEN 4
#define OGS_GTP2_NUM_OF_EXTENSION_HEADER 8
} __attribute__ ((packed)) array[OGS_GTP2_NUM_OF_EXTENSION_HEADER];
} __attribute__ ((packed)) ogs_gtp2_extension_header_t;