mirror of
https://github.com/open5gs/open5gs.git
synced 2025-10-23 07:41:57 +00:00
3978db2fa6
When the NGSetupRequest contains an invalid GlobalRANNodeID or BroadcastPLMNItem with a malformed PLMNIdentity, the AMF previously performed memcpy() without checking the buffer size. This could lead to invalid memory access and crash. Fix by validating PLMNIdentity size against sizeof(ogs_plmn_id_t) and sending NGSetupFailure with CauseProtocol_semantic_error if invalid. Also add regression tests: - Build malformed NGSetupRequest with incorrect PLMNIdentity size - Verify AMF does not crash and returns NGSetupFailure This resolves the crash reported in issue #4087.