From: Victor Seva <vseva@sipwork.pro>
Date: Tue, 14 Jul 2026 10:14:12 +0000 (+0200)
Subject: ims_icscf: check len before get_4bytes()
X-Git-Tag: archive/raspbian/6.0.1-1+rpi1+deb13u2^2~6
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=f4fcde120250f145b311ff0e0b82a0e973bac9bb;p=kamailio.git

ims_icscf: check len before get_4bytes()

(cherry picked from commit fd208b0fab7eba80ea4b80e9ff1c22c733619b65)
(cherry picked from commit fc616d62e44bee65de3e83cd3ec7e10742b9aec9)

Gbp-Pq: Topic upstream
Gbp-Pq: Name ims_icscf-check-len-before-get_4bytes.patch
---

diff --git a/src/modules/ims_icscf/cxdx_avp.c b/src/modules/ims_icscf/cxdx_avp.c
index 95fe98db..fa5637ff 100644
--- a/src/modules/ims_icscf/cxdx_avp.c
+++ b/src/modules/ims_icscf/cxdx_avp.c
@@ -294,7 +294,7 @@ int cxdx_get_result_code(AAAMessage *msg, int *data)
 {
 	str s;
 	s = cxdx_get_avp(msg, AVP_Result_Code, 0, __FUNCTION__);
-	if(!s.s)
+	if(!s.s || s.len < 4)
 		return 0;
 	*data = get_4bytes(s.s);
 	return 1;
@@ -318,7 +318,7 @@ int cxdx_get_experimental_result_code(AAAMessage *msg, int *data)
 
 	avp = cdpb.AAAFindMatchingAVPList(
 			list, 0, AVP_IMS_Experimental_Result_Code, 0, 0);
-	if(!avp || !avp->data.s) {
+	if(!avp || !avp->data.s || avp->data.len < 4) {
 		cdpb.AAAFreeAVPList(&list);
 		return 0;
 	}
@@ -396,12 +396,21 @@ int cxdx_get_capabilities(AAAMessage *msg, int **m, int *m_cnt, int **o,
 	*o_cnt = 0;
 	*p_cnt = 0;
 	while(avp) {
-		if(avp->code == AVP_IMS_Mandatory_Capability)
-			(*m)[(*m_cnt)++] = get_4bytes(avp->data.s);
-		if(avp->code == AVP_IMS_Optional_Capability)
-			(*o)[(*o_cnt)++] = get_4bytes(avp->data.s);
-		if(avp->code == AVP_IMS_Server_Name)
-			(*p)[(*p_cnt)++] = avp->data;
+		switch(avp->code) {
+			case AVP_IMS_Mandatory_Capability:
+				if(!avp->data.s || avp->data.len < 4)
+					break;
+				(*m)[(*m_cnt)++] = get_4bytes(avp->data.s);
+				break;
+			case AVP_IMS_Optional_Capability:
+				if(!avp->data.s || avp->data.len < 4)
+					break;
+				(*o)[(*o_cnt)++] = get_4bytes(avp->data.s);
+				break;
+			case AVP_IMS_Server_Name:
+				(*p)[(*p_cnt)++] = avp->data;
+				break;
+		}
 		avp = avp->next;
 	}
 	cdpb.AAAFreeAVPList(&list);
@@ -510,7 +519,7 @@ int cxdx_get_sip_number_auth_items(AAAMessage *msg, int *data)
 	str s;
 	s = cxdx_get_avp(msg, AVP_IMS_SIP_Number_Auth_Items, IMS_vendor_id_3GPP,
 			__FUNCTION__);
-	if(!s.s)
+	if(!s.s || s.len < 4)
 		return 0;
 	*data = get_4bytes(s.s);
 	return 1;