From cd89fe50643e8f4c535d57e40411c57462c82673 Mon Sep 17 00:00:00 2001 From: Victor Seva Date: Tue, 14 Jul 2026 12:47:34 +0200 Subject: [PATCH] ims_qos_npn: check len before get_4bytes() (cherry picked from commit e6ff84fea2da24e385b75928a3cf6d32e063d8f9) (cherry picked from commit 801b7629fb038f1d78c787c132144141b84e13f7) Gbp-Pq: Topic upstream Gbp-Pq: Name ims_qos_npn-check-len-before-get_4bytes.patch --- src/modules/ims_qos_npn/rx_avp.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/src/modules/ims_qos_npn/rx_avp.c b/src/modules/ims_qos_npn/rx_avp.c index fd17533c..966ab04d 100644 --- a/src/modules/ims_qos_npn/rx_avp.c +++ b/src/modules/ims_qos_npn/rx_avp.c @@ -1313,7 +1313,7 @@ unsigned int rx_get_abort_cause(AAAMessage *msg) //getting abort cause avp = cdpb.AAAFindMatchingAVP(msg, msg->avpList.head, AVP_IMS_Abort_Cause, IMS_vendor_id_3GPP, AAA_FORWARD_SEARCH); - if(avp) { + if(avp && avp->data.s && avp->data.len >= 4) { code = get_4bytes(avp->data.s); } return code; @@ -1338,17 +1338,21 @@ inline int rx_get_result_code(AAAMessage *msg, unsigned int *data) for(avp = msg->avpList.tail; avp; avp = avp->prev) { //LOG(L_INFO,"pcc_get_result_code: looping with avp code %i\n",avp->code); if(avp->code == AVP_Result_Code) { - *data = get_4bytes(avp->data.s); - ret = 1; + if(avp->data.s && avp->data.len >= 4) { + *data = get_4bytes(avp->data.s); + ret = 1; + } } else if(avp->code == AVP_Experimental_Result) { list = cdpb.AAAUngroupAVPS(avp->data); for(avp = list.head; avp; avp = avp->next) { //LOG(L_CRIT,"in the loop with avp code %i\n",avp->code); if(avp->code == AVP_IMS_Experimental_Result_Code) { - *data = get_4bytes(avp->data.s); - cdpb.AAAFreeAVPList(&list); - ret = 1; + if(avp->data.s && avp->data.len >= 4) { + *data = get_4bytes(avp->data.s); + cdpb.AAAFreeAVPList(&list); + ret = 1; + } break; } } -- 2.30.2