mirror of
https://github.com/open5gs/open5gs.git
synced 2026-10-19 09:44:04 +00:00
c56ad08e00
Malformed IMEISV, IMSI, SGsAP and PCO fields could trigger out-of-bounds accesses or assertions on peer-controlled input. - Require a 9-octet, even-parity IMEISV before writing its 16 digits and terminator. Leave the output unchanged on failure and have MME/AMF skip storing rejected identities. Preserve the existing filler and digit acceptance policy. - Check the AMF IMEISV length before reading its identity type, including when the received IE has zero length. - Validate the SGWC IMSI before UE lookup, which asserts on an empty hash key, and reject nonpositive lengths in UE creation. - Replace SGsAP DOWNLINK-UNITDATA assertions on received IMSI and NAS container fields with error logging and early returns. - Check the original GTP PCO length against the NAS destination size before narrowing or copying. Omit an oversized optional PCO instead of failing the builder, since callers assert on message-build failure. |
||
|---|---|---|
| .. | ||
| 310014 | ||
| af | ||
| app | ||
| attach | ||
| common | ||
| core | ||
| crypt | ||
| csfb | ||
| dns | ||
| eir | ||
| fuzzing | ||
| handover | ||
| non3gpp | ||
| registration | ||
| sctp | ||
| slice | ||
| transfer | ||
| unit | ||
| volte | ||
| vonr | ||
| meson.build | ||