From: Victor Seva <vseva@sipwork.pro>
Date: Tue, 14 Jul 2026 10:50:17 +0000 (+0200)
Subject: ims_registrar_scscf: check len before get_4bytes()
X-Git-Tag: archive/raspbian/6.0.1-1+rpi1+deb13u2^2~1
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=001bade825accdecb2c2de8e767aa8f1b21f8eed;p=kamailio.git

ims_registrar_scscf: check len before get_4bytes()

(cherry picked from commit abb5d60af6eefbd367bf6588c5589566b090e272)
(cherry picked from commit 062702b948f4264622a341ea9216c0d2cb380385)

Gbp-Pq: Topic upstream
Gbp-Pq: Name ims_registrar_scscf-check-len-before-get_4bytes.patch
---

diff --git a/src/modules/ims_registrar_scscf/cxdx_avp.c b/src/modules/ims_registrar_scscf/cxdx_avp.c
index 99248082..a01e13e1 100644
--- a/src/modules/ims_registrar_scscf/cxdx_avp.c
+++ b/src/modules/ims_registrar_scscf/cxdx_avp.c
@@ -301,7 +301,7 @@ int cxdx_get_result_code(AAAMessage *msg, int *data)
 {
 	str s;
 	s = cxdx_get_avp(msg, AVP_Result_Code, 0, __FUNCTION__);
-	if(!s.s)
+	if(!s.s || s.len < 4)
 		return 0;
 	*data = get_4bytes(s.s);
 	return 1;
@@ -325,7 +325,7 @@ int cxdx_get_experimental_result_code(AAAMessage *msg, int *data)
 
 	avp = cdpb.AAAFindMatchingAVPList(
 			list, 0, AVP_IMS_Experimental_Result_Code, 0, 0);
-	if(!avp || !avp->data.s) {
+	if(!avp || !avp->data.s || avp->data.len < 4) {
 		cdpb.AAAFreeAVPList(&list);
 		return 0;
 	}
@@ -403,12 +403,21 @@ int cxdx_get_capabilities(AAAMessage *msg, int **m, int *m_cnt, int **o,
 	*o_cnt = 0;
 	*p_cnt = 0;
 	while(avp) {
-		if(avp->code == AVP_IMS_Mandatory_Capability)
-			(*m)[(*m_cnt)++] = get_4bytes(avp->data.s);
-		if(avp->code == AVP_IMS_Optional_Capability)
-			(*o)[(*o_cnt)++] = get_4bytes(avp->data.s);
-		if(avp->code == AVP_IMS_Server_Name)
-			(*p)[(*p_cnt)++] = avp->data;
+		switch(avp->code) {
+			case AVP_IMS_Mandatory_Capability:
+				if(!avp->data.s || avp->data.len < 4)
+					break;
+				(*m)[(*m_cnt)++] = get_4bytes(avp->data.s);
+				break;
+			case AVP_IMS_Optional_Capability:
+				if(!avp->data.s || avp->data.len < 4)
+					break;
+				(*o)[(*o_cnt)++] = get_4bytes(avp->data.s);
+				break;
+			case AVP_IMS_Server_Name:
+				(*p)[(*p_cnt)++] = avp->data;
+				break;
+		}
 		avp = avp->next;
 	}
 	cdpb.AAAFreeAVPList(&list);
@@ -535,7 +544,7 @@ int cxdx_get_sip_number_auth_items(AAAMessage *msg, int *data)
 	str s;
 	s = cxdx_get_avp(msg, AVP_IMS_SIP_Number_Auth_Items, IMS_vendor_id_3GPP,
 			__FUNCTION__);
-	if(!s.s)
+	if(!s.s || s.len < 4)
 		return 0;
 	*data = get_4bytes(s.s);
 	return 1;