From fe87809c92b6059b6b25c110b200a5d60c842f7b Mon Sep 17 00:00:00 2001 From: Neels Hofmeyr Date: Fri, 25 Nov 2016 13:13:31 +0100 Subject: hnbgw_rua: reject invalid domain indicator Fixes: CID#135226, CID#135227 Change-Id: I0c44179aac02772585214e528207e959ad168f3c --- src/hnbgw_rua.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'src/hnbgw_rua.c') diff --git a/src/hnbgw_rua.c b/src/hnbgw_rua.c index 3f245b5..ca745b1 100644 --- a/src/hnbgw_rua.c +++ b/src/hnbgw_rua.c @@ -347,6 +347,11 @@ static int rua_rx_init_disconnect(struct msgb *msg, ANY_t *in) case RUA_CN_DomainIndicator_ps_domain: cn = hnb->gw->cnlink_ps; break; + default: + LOGP(DRUA, LOGL_ERROR, "Invalid CN_DomainIndicator: %u\n", + ies.cN_DomainIndicator); + rc = -1; + goto error_free; } if (ies.presenceMask & DISCONNECTIES_RUA_RANAP_MESSAGE_PRESENT) { @@ -356,6 +361,8 @@ static int rua_rx_init_disconnect(struct msgb *msg, ANY_t *in) rc = rua_to_scu(hnb, cn, OSMO_SCU_PRIM_N_DISCONNECT, context_id, scu_cause, ranap_data, ranap_len); + +error_free: /* FIXME: what to do with the asn1c-allocated memory */ rua_free_disconnecties(&ies); @@ -386,11 +393,18 @@ static int rua_rx_init_dt(struct msgb *msg, ANY_t *in) case RUA_CN_DomainIndicator_ps_domain: cn = hnb->gw->cnlink_ps; break; + default: + LOGP(DRUA, LOGL_ERROR, "Invalid CN_DomainIndicator: %u\n", + ies.cN_DomainIndicator); + rc = -1; + goto error_free; } rc = rua_to_scu(hnb, cn, OSMO_SCU_PRIM_N_DATA, context_id, 0, ies.ranaP_Message.buf, ies.ranaP_Message.size); + +error_free: /* FIXME: what to do with the asn1c-allocated memory */ rua_free_directtransferies(&ies); -- cgit v1.2.3