forked from acouzens/open5gs
[GTPU] Fixed Stack-Buffer-Overflow in GTPU (#2609)
This commit is contained in:
parent
bfe8ae659e
commit
aa746794e7
|
@ -76,6 +76,12 @@ int ogs_gtpu_parse_header(
|
|||
ogs_error("No length in the Extension header");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (((*ext_h) * 4) > OGS_GTP2_MAX_EXTENSION_HEADER_LEN) {
|
||||
ogs_error("Overflow length : %d", (*ext_h));
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (pkbuf->len < len) {
|
||||
ogs_error("the length of the packet is insufficient[%d:%d]",
|
||||
pkbuf->len, len);
|
||||
|
|
|
@ -73,6 +73,10 @@ typedef struct ogs_gtp2_extension_header_s {
|
|||
uint16_t udp_port;
|
||||
uint16_t pdcp_number;
|
||||
};
|
||||
|
||||
/* sizeof(extension_header.array[i]) */
|
||||
#define OGS_GTP2_MAX_EXTENSION_HEADER_LEN 4
|
||||
|
||||
#define OGS_GTP2_NUM_OF_EXTENSION_HEADER 8
|
||||
} __attribute__ ((packed)) array[OGS_GTP2_NUM_OF_EXTENSION_HEADER];
|
||||
} __attribute__ ((packed)) ogs_gtp2_extension_header_t;
|
||||
|
|
Loading…
Reference in New Issue