ims_qos: check len before get_4bytes()

(cherry picked from commit 45b30ecfa04c79ebc40afa76b60c17d000b65f82)
(cherry picked from commit 1a276ee343dde0454d1f28cc69c1c2bff8113541)

Gbp-Pq: Topic upstream
Gbp-Pq: Name ims_qos-check-len-before-get_4bytes.patch

diff --git a/src/modules/ims_qos/rx_avp.c b/src/modules/ims_qos/rx_avp.c
index 4fb750d2f6f1fb8059093306f6eef289ba28b43f..66682bed0d6dec08fb24a2d8e829017419c9d4d7 100644 (file)
--- a/src/modules/ims_qos/rx_avp.c
+++ b/src/modules/ims_qos/rx_avp.c
@@ -1313,7 +1313,7 @@ unsigned int rx_get_abort_cause(AAAMessage *msg)
        //getting abort cause
        avp = cdpb.AAAFindMatchingAVP(msg, msg->avpList.head, AVP_IMS_Abort_Cause,
                        IMS_vendor_id_3GPP, AAA_FORWARD_SEARCH);
-       if(avp) {
+       if(avp && avp->data.s && avp->data.len >= 4) {
                code = get_4bytes(avp->data.s);
        }
        return code;
@@ -1338,17 +1338,21 @@ inline int rx_get_result_code(AAAMessage *msg, unsigned int *data)
        for(avp = msg->avpList.tail; avp; avp = avp->prev) {
                //LOG(L_INFO,"pcc_get_result_code: looping with avp code %i\n",avp->code);
                if(avp->code == AVP_Result_Code) {
-                       *data = get_4bytes(avp->data.s);
-                       ret = 1;
+                       if(avp->data.s && avp->data.len >= 4) {
+                               *data = get_4bytes(avp->data.s);
+                               ret = 1;
+                       }
 
                } else if(avp->code == AVP_Experimental_Result) {
                        list = cdpb.AAAUngroupAVPS(avp->data);
                        for(avp = list.head; avp; avp = avp->next) {
                                //LOG(L_CRIT,"in the loop with avp code %i\n",avp->code);
                                if(avp->code == AVP_IMS_Experimental_Result_Code) {
-                                       *data = get_4bytes(avp->data.s);
-                                       cdpb.AAAFreeAVPList(&list);
-                                       ret = 1;
+                                       if(avp->data.s && avp->data.len >= 4) {
+                                               *data = get_4bytes(avp->data.s);
+                                               cdpb.AAAFreeAVPList(&list);
+                                               ret = 1;
+                                       }
                                        break;
                                }
                        }