From: Victor Seva <vseva@sipwork.pro>
Date: Tue, 14 Jul 2026 10:47:34 +0000 (+0200)
Subject: ims_qos_npn: check len before get_4bytes()
X-Git-Tag: archive/raspbian/6.0.1-1+rpi1+deb13u2^2~2
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=cd89fe50643e8f4c535d57e40411c57462c82673;p=kamailio.git

ims_qos_npn: check len before get_4bytes()

(cherry picked from commit e6ff84fea2da24e385b75928a3cf6d32e063d8f9)
(cherry picked from commit 801b7629fb038f1d78c787c132144141b84e13f7)

Gbp-Pq: Topic upstream
Gbp-Pq: Name ims_qos_npn-check-len-before-get_4bytes.patch
---

diff --git a/src/modules/ims_qos_npn/rx_avp.c b/src/modules/ims_qos_npn/rx_avp.c
index fd17533c..966ab04d 100644
--- a/src/modules/ims_qos_npn/rx_avp.c
+++ b/src/modules/ims_qos_npn/rx_avp.c
@@ -1313,7 +1313,7 @@ unsigned int rx_get_abort_cause(AAAMessage *msg)
 	//getting abort cause
 	avp = cdpb.AAAFindMatchingAVP(msg, msg->avpList.head, AVP_IMS_Abort_Cause,
 			IMS_vendor_id_3GPP, AAA_FORWARD_SEARCH);
-	if(avp) {
+	if(avp && avp->data.s && avp->data.len >= 4) {
 		code = get_4bytes(avp->data.s);
 	}
 	return code;
@@ -1338,17 +1338,21 @@ inline int rx_get_result_code(AAAMessage *msg, unsigned int *data)
 	for(avp = msg->avpList.tail; avp; avp = avp->prev) {
 		//LOG(L_INFO,"pcc_get_result_code: looping with avp code %i\n",avp->code);
 		if(avp->code == AVP_Result_Code) {
-			*data = get_4bytes(avp->data.s);
-			ret = 1;
+			if(avp->data.s && avp->data.len >= 4) {
+				*data = get_4bytes(avp->data.s);
+				ret = 1;
+			}
 
 		} else if(avp->code == AVP_Experimental_Result) {
 			list = cdpb.AAAUngroupAVPS(avp->data);
 			for(avp = list.head; avp; avp = avp->next) {
 				//LOG(L_CRIT,"in the loop with avp code %i\n",avp->code);
 				if(avp->code == AVP_IMS_Experimental_Result_Code) {
-					*data = get_4bytes(avp->data.s);
-					cdpb.AAAFreeAVPList(&list);
-					ret = 1;
+					if(avp->data.s && avp->data.len >= 4) {
+						*data = get_4bytes(avp->data.s);
+						cdpb.AAAFreeAVPList(&list);
+						ret = 1;
+					}
 					break;
 				}
 			}