Skip to content
Permalink
Browse files Browse the repository at this point in the history
A crafted packet from UE can crash SGW-U/UPF
  • Loading branch information
acetcom committed Dec 22, 2021
1 parent 6f62839 commit a0f2535
Show file tree
Hide file tree
Showing 3 changed files with 18 additions and 0 deletions.
6 changes: 6 additions & 0 deletions src/sgwu/gtp-path.c
Expand Up @@ -124,6 +124,12 @@ static void _gtpv1_u_recv_cb(short when, ogs_socket_t fd, void *data)
ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
goto cleanup;
}
if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER &&
pkbuf->len <= len) {
ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len);
ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
goto cleanup;
}
ogs_assert(ogs_pkbuf_pull(pkbuf, len));

if (gtp_h->type == OGS_GTPU_MSGTYPE_END_MARKER) {
Expand Down
6 changes: 6 additions & 0 deletions src/smf/gtp-path.c
Expand Up @@ -186,6 +186,12 @@ static void _gtpv1_u_recv_cb(short when, ogs_socket_t fd, void *data)
ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
goto cleanup;
}
if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER &&
pkbuf->len <= len) {
ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len);
ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
goto cleanup;
}
ogs_assert(ogs_pkbuf_pull(pkbuf, len));

if (gtp_h->type == OGS_GTPU_MSGTYPE_GPDU) {
Expand Down
6 changes: 6 additions & 0 deletions src/upf/gtp-path.c
Expand Up @@ -304,6 +304,12 @@ static void _gtpv1_u_recv_cb(short when, ogs_socket_t fd, void *data)
ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
goto cleanup;
}
if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER &&
pkbuf->len <= len) {
ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len);
ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
goto cleanup;
}
ogs_assert(ogs_pkbuf_pull(pkbuf, len));

if (gtp_h->type == OGS_GTPU_MSGTYPE_END_MARKER) {
Expand Down

0 comments on commit a0f2535

Please sign in to comment.