paulmataruso/open5gs
1
0
Fork 0
mirror of https://github.com/open5gs/open5gs.git synced 2025-11-02 13:03:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

[UPF] Fixed an infinte loop when ext_len is 0

Browse Source
This commit is contained in:
Sukchan Lee
2022-11-30 16:40:57 +09:00
parent c5bf02313f
commit 2319375ea7
1 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
lib/gtp/util.c
View File

@@ -31,12 +31,20 @@ int ogs_gtpu_header_len(ogs_pkbuf_t *pkbuf)
gtp_h = (ogs_gtp2_header_t *)pkbuf->data;
len = OGS_GTPV1U_HEADER_LEN;
if (pkbuf->len < len) return -1;
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);
return -1;
}
if (gtp_h->flags & OGS_GTPU_FLAGS_E) {
len += OGS_GTPV1U_EXTENSION_HEADER_LEN;
if (pkbuf->len < len) return -1;
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);
return -1;
}
/*
* TS29.281
@@ -51,7 +59,15 @@ int ogs_gtpu_header_len(ogs_pkbuf_t *pkbuf)
* where n is a positive integer.
*/
len += (*(++ext_h)) * 4;
if (pkbuf->len < len) return -1;
if (*ext_h == 0) {
ogs_error("No length in the Extension header");
return -1;
}
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);
return -1;
}
}
} else if (gtp_h->flags & (OGS_GTPU_FLAGS_S|OGS_GTPU_FLAGS_PN)) {
@@ -68,7 +84,11 @@ int ogs_gtpu_header_len(ogs_pkbuf_t *pkbuf)
len += 4;
}
if (pkbuf->len < len) return -1;
if (pkbuf->len < len) {
ogs_error("the length of the packet is insufficient[%d:%d]",
pkbuf->len, len);
return -1;
}
return len;
}