ims_qos_npn: check len before get_4bytes()

(cherry picked from commit e6ff84fea2da24e385b75928a3cf6d32e063d8f9)
(cherry picked from commit 801b7629fb038f1d78c787c132144141b84e13f7)

Gbp-Pq: Topic upstream
Gbp-Pq: Name ims_qos_npn-check-len-before-get_4bytes.patch

diff --git a/src/modules/ims_qos_npn/rx_avp.c b/src/modules/ims_qos_npn/rx_avp.c
index fd17533c99a08e5512ca7bd036d2f8efaaeaf6c5..966ab04d1b48f70c9abc9647a9f146cdefcedee9 100644 (file)
--- a/src/modules/ims_qos_npn/rx_avp.c
+++ b/src/modules/ims_qos_npn/rx_avp.c
@@ -1313,7 +1313,7 @@ unsigned int rx_get_abort_cause(AAAMessage *msg)
        //getting abort cause
        avp = cdpb.AAAFindMatchingAVP(msg, msg->avpList.head, AVP_IMS_Abort_Cause,
                        IMS_vendor_id_3GPP, AAA_FORWARD_SEARCH);
-       if(avp) {
+       if(avp && avp->data.s && avp->data.len >= 4) {
                code = get_4bytes(avp->data.s);
        }
        return code;
@@ -1338,17 +1338,21 @@ inline int rx_get_result_code(AAAMessage *msg, unsigned int *data)
        for(avp = msg->avpList.tail; avp; avp = avp->prev) {
                //LOG(L_INFO,"pcc_get_result_code: looping with avp code %i\n",avp->code);
                if(avp->code == AVP_Result_Code) {
-                       *data = get_4bytes(avp->data.s);
-                       ret = 1;
+                       if(avp->data.s && avp->data.len >= 4) {
+                               *data = get_4bytes(avp->data.s);
+                               ret = 1;
+                       }
 
                } else if(avp->code == AVP_Experimental_Result) {
                        list = cdpb.AAAUngroupAVPS(avp->data);
                        for(avp = list.head; avp; avp = avp->next) {
                                //LOG(L_CRIT,"in the loop with avp code %i\n",avp->code);
                                if(avp->code == AVP_IMS_Experimental_Result_Code) {
-                                       *data = get_4bytes(avp->data.s);
-                                       cdpb.AAAFreeAVPList(&list);
-                                       ret = 1;
+                                       if(avp->data.s && avp->data.len >= 4) {
+                                               *data = get_4bytes(avp->data.s);
+                                               cdpb.AAAFreeAVPList(&list);
+                                               ret = 1;
+                                       }
                                        break;
                                }
                        }