ims_icscf: check len before get_4bytes()

(cherry picked from commit fd208b0fab7eba80ea4b80e9ff1c22c733619b65)
(cherry picked from commit fc616d62e44bee65de3e83cd3ec7e10742b9aec9)

Gbp-Pq: Topic upstream
Gbp-Pq: Name ims_icscf-check-len-before-get_4bytes.patch

diff --git a/src/modules/ims_icscf/cxdx_avp.c b/src/modules/ims_icscf/cxdx_avp.c
index 95fe98db26bfde43550b76037a0d3ef79a94f13d..fa5637ffbb4bd379e4ea184b48e82f916dc31139 100644 (file)
--- a/src/modules/ims_icscf/cxdx_avp.c
+++ b/src/modules/ims_icscf/cxdx_avp.c
@@ -294,7 +294,7 @@ int cxdx_get_result_code(AAAMessage *msg, int *data)
 {
        str s;
        s = cxdx_get_avp(msg, AVP_Result_Code, 0, __FUNCTION__);
-       if(!s.s)
+       if(!s.s || s.len < 4)
                return 0;
        *data = get_4bytes(s.s);
        return 1;
@@ -318,7 +318,7 @@ int cxdx_get_experimental_result_code(AAAMessage *msg, int *data)
 
        avp = cdpb.AAAFindMatchingAVPList(
                        list, 0, AVP_IMS_Experimental_Result_Code, 0, 0);
-       if(!avp || !avp->data.s) {
+       if(!avp || !avp->data.s || avp->data.len < 4) {
                cdpb.AAAFreeAVPList(&list);
                return 0;
        }
@@ -396,12 +396,21 @@ int cxdx_get_capabilities(AAAMessage *msg, int **m, int *m_cnt, int **o,
        *o_cnt = 0;
        *p_cnt = 0;
        while(avp) {
-               if(avp->code == AVP_IMS_Mandatory_Capability)
-                       (*m)[(*m_cnt)++] = get_4bytes(avp->data.s);
-               if(avp->code == AVP_IMS_Optional_Capability)
-                       (*o)[(*o_cnt)++] = get_4bytes(avp->data.s);
-               if(avp->code == AVP_IMS_Server_Name)
-                       (*p)[(*p_cnt)++] = avp->data;
+               switch(avp->code) {
+                       case AVP_IMS_Mandatory_Capability:
+                               if(!avp->data.s || avp->data.len < 4)
+                                       break;
+                               (*m)[(*m_cnt)++] = get_4bytes(avp->data.s);
+                               break;
+                       case AVP_IMS_Optional_Capability:
+                               if(!avp->data.s || avp->data.len < 4)
+                                       break;
+                               (*o)[(*o_cnt)++] = get_4bytes(avp->data.s);
+                               break;
+                       case AVP_IMS_Server_Name:
+                               (*p)[(*p_cnt)++] = avp->data;
+                               break;
+               }
                avp = avp->next;
        }
        cdpb.AAAFreeAVPList(&list);
@@ -510,7 +519,7 @@ int cxdx_get_sip_number_auth_items(AAAMessage *msg, int *data)
        str s;
        s = cxdx_get_avp(msg, AVP_IMS_SIP_Number_Auth_Items, IMS_vendor_id_3GPP,
                        __FUNCTION__);
-       if(!s.s)
+       if(!s.s || s.len < 4)
                return 0;
        *data = get_4bytes(s.s);
        return 1;