From: Victor Seva <vseva@sipwork.pro>
Date: Tue, 14 Jul 2026 10:36:12 +0000 (+0200)
Subject: ims_qos: check len before get_4bytes()
X-Git-Tag: archive/raspbian/6.0.1-1+rpi1+deb13u2^2~3
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=8ebaf7755272c1c86c6ccec00c9dbb9793cccedf;p=kamailio.git

ims_qos: check len before get_4bytes()

(cherry picked from commit 45b30ecfa04c79ebc40afa76b60c17d000b65f82)
(cherry picked from commit 1a276ee343dde0454d1f28cc69c1c2bff8113541)

Gbp-Pq: Topic upstream
Gbp-Pq: Name ims_qos-check-len-before-get_4bytes.patch
---

diff --git a/src/modules/ims_qos/rx_avp.c b/src/modules/ims_qos/rx_avp.c
index 4fb750d2..66682bed 100644
--- a/src/modules/ims_qos/rx_avp.c
+++ b/src/modules/ims_qos/rx_avp.c
@@ -1313,7 +1313,7 @@ unsigned int rx_get_abort_cause(AAAMessage *msg)
 	//getting abort cause
 	avp = cdpb.AAAFindMatchingAVP(msg, msg->avpList.head, AVP_IMS_Abort_Cause,
 			IMS_vendor_id_3GPP, AAA_FORWARD_SEARCH);
-	if(avp) {
+	if(avp && avp->data.s && avp->data.len >= 4) {
 		code = get_4bytes(avp->data.s);
 	}
 	return code;
@@ -1338,17 +1338,21 @@ inline int rx_get_result_code(AAAMessage *msg, unsigned int *data)
 	for(avp = msg->avpList.tail; avp; avp = avp->prev) {
 		//LOG(L_INFO,"pcc_get_result_code: looping with avp code %i\n",avp->code);
 		if(avp->code == AVP_Result_Code) {
-			*data = get_4bytes(avp->data.s);
-			ret = 1;
+			if(avp->data.s && avp->data.len >= 4) {
+				*data = get_4bytes(avp->data.s);
+				ret = 1;
+			}
 
 		} else if(avp->code == AVP_Experimental_Result) {
 			list = cdpb.AAAUngroupAVPS(avp->data);
 			for(avp = list.head; avp; avp = avp->next) {
 				//LOG(L_CRIT,"in the loop with avp code %i\n",avp->code);
 				if(avp->code == AVP_IMS_Experimental_Result_Code) {
-					*data = get_4bytes(avp->data.s);
-					cdpb.AAAFreeAVPList(&list);
-					ret = 1;
+					if(avp->data.s && avp->data.len >= 4) {
+						*data = get_4bytes(avp->data.s);
+						cdpb.AAAFreeAVPList(&list);
+						ret = 1;
+					}
 					break;
 				}
 			}